CVE-2026-48043

About vulnerability

Impact

The DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled ByteBuf handed to an anonymous ChannelInboundHandlerAdapter tail handler, which becomes the sole owner responsible for releasing it.

A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME.

Affected product:

Apache CXF , Apache Hadoop , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Netty , Spring , Wildfly , alluxio , amazon-kinesis-client , amqp-10-jms-spring-boot , artemis , async-http-client , avro , aws-sdk-java , aws-sdk-java-v2 , azure-sdk-for-java , azure-search-documents , bolt-connection-java , bookkeeper , bookkeeper-common-allocator , camel , cassandra-java-driver , corda , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , cypher-dsl , distributedlog , flink , flink-shaded , flume , googleapis , grpc-java , hbase , hbase-thirdparty , infinispan , jaeger-analytics-java , java-datastore , java-driver , jersey , lettuce , logging-flume , metrics , micrometer , micronaut-core , neo4j-java-driver , neo4j-ogm , olingo-odata4 , pinecone-java-client , pulsar , qpid-jms , rabbitmq-java-client , rabbitmq-stream-java-client , redisson , rsocket-java , sdk-platform-java , tika , vert.x , zookeeper

Affected packages:

netty-transport-native-epoll @ 4.1.86.Final (+13389 more)