CVE-2026-45536 Netty: Unix-socket fd receive leaks descriptors when peer sends two at once

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, nettyunixsocketrecvFd sets msgcontrol to char controlCMSGSPACEsizeofint line 940 — 24 bytes on 64-bit Linux. A peer-sent SCMRIGHTS cmsg carrying two ints has...

Linux Distros Unpatched Vulnerability : CVE-2026-45536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, nettyunixsocketrecvF...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +1737 more potentially affected by CVE-2026-45536 via io.netty:netty-transport-native-epoll (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-transport-native-epoll MAVEN version =4.2.0.Final, =0.1.0, =0.1.0, =0.1.0-M41, =0.1.0-M41, =0.1.0-M41, =0.1.0-M41, =9.0.1, =0.0.5, =0.0.1-alfa, =0.0.1-demo, =6.0.1, =6.0.1, =6.0.2 and more Source cves: CVE-2026-45536 Source advisory: OSV:GHSA-W573-9FFJ-6FF9...

ai.spice:spiceai (=0.6.0), app.fmgp:cardano-prism-cli_3 (>=0.1.0-M41 <=0.1.0-M48) +972 more potentially affected by CVE-2026-45536 via io.netty:netty-transport-native-kqueue (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-transport-native-kqueue MAVEN version =4.2.0.Final, =0.1.0-M41, =0.1.0-M41, =0.1.0-M41, =0.1.0-M41, =4.0.3-M1, =1.21.9, =3.4.7, =6.0.0, =25.4.1, =26.2.1, =26.6.1 and more Source cves: CVE-2026-45536 Source advisory: OSV:GHSA-W573-9FFJ-6FF9...