CVE-2026-45536: Netty Unix Domain Socket File Descriptor Leak in DomainSocketChannel

Technical summary

The vulnerability exists in netty_unix_socket_recvFd, which allocates a 24-byte control buffer (char control[CMSG_SPACE(sizeof(int))]) to receive ancillary data from recvmsg. A peer-sent SCM_RIGHTS cmsg containing two integers has a cmsg_len of 24 bytes, fitting exactly without truncation. The code validates received cmsg_len against CMSG_LEN(sizeof(int)) (20 bytes), expecting a single fd; when this check fails for a two-fd message, the branch that would read and close the file descriptors is skipped. The non-blocking recvmsg returns EAGAIN, the Java read loop exits, and both installed file descriptors remain open but orphaned. There is no MSG_CTRUNC detection to handle intentionally overflowed messages. Affected versions prior to 4.1.135.Final and 4.2.15.Final are vulnerable.

Business impact

For applications using Netty's DomainSocketChannel with FILE_DESCRIPTORS mode enabled, a local attacker (peer on the same host) can repeatedly send crafted messages to exhaust the application process's file descriptor limit. Once FD exhaustion occurs, the application cannot accept new connections, open files, or perform network operations, resulting in denial of service. The attack requires local access and knowledge that the target uses this non-default feature, but the exploit is trivial to execute. In containerized or shared-tenant environments, this risk is elevated.

Affected systems

Netty versions prior to 4.1.135.Final (4.1.x branch) and prior to 4.2.15.Final (4.2.x branch) are affected. Only applications that explicitly opt into DomainSocketReadMode.FILE_DESCRIPTORS when configuring DomainSocketChannel are vulnerable; this is not the default behavior. Affected deployments are typically those running on Linux with Epoll or macOS with KQueue event loops and passing multi-fd Unix socket messages between processes.

Exploitability

Exploitability is straightforward for a local attacker with the ability to establish a Unix domain socket connection to the vulnerable process. No privilege escalation or network capability is required. The attack is not in CISA's Known Exploited Vulnerabilities catalog and has not been widely published, but the mechanics are elementary: send a two-fd SCM_RIGHTS message repeatedly. Exploitation is limited to local peers, reducing widespread risk, but is reliable and requires minimal effort once the target application is identified.

Remediation

Upgrade affected Netty deployments to version 4.1.135.Final or later for the 4.1.x series, or 4.2.15.Final or later for the 4.2.x series. These versions correct the control buffer size and add proper MSG_CTRUNC handling to detect oversized messages. Patched releases ensure that either the correct number of file descriptors are read and managed, or that truncation is detected and the message is rejected. No workarounds short of upgrading are available for applications requiring FILE_DESCRIPTORS mode.

Patch guidance

Verify the exact version deployed in your build or dependency manifest (e.g., Maven pom.xml, Gradle build.gradle, or equivalent). Consult the Netty project's official release notes to confirm that versions 4.1.135.Final, 4.2.15.Final, or later appear in your dependency tree. If using a transitive dependency, ensure the resolved version meets the patched threshold; force resolution if necessary. Test in a staging environment to confirm the patch does not introduce regressions, then schedule a rolling deployment to minimize downtime.

Detection guidance

Monitor application logs and system metrics for signs of file descriptor exhaustion: check /proc/[pid]/fd count, observe warnings about 'too many open files' or 'permission denied' errors on socket or file operations, and correlate with local network traffic or connections. If FILE_DESCRIPTORS mode is in use, enable debug logging on Netty's epoll or KQueue channel implementations to capture cmsg validation failures. Network-level detection is difficult because the attack occurs entirely over Unix domain sockets, but endpoint monitoring of syscall patterns (repeated recvmsg on AF_UNIX followed by fd exhaustion) can provide signals.

Why prioritize this

This vulnerability should be prioritized for patching in the following order: (1) immediately, if your Netty deployment uses DomainSocketReadMode.FILE_DESCRIPTORS and receives untrusted Unix socket connections from other local processes, (2) within a standard patching cycle (e.g., next maintenance window), if FILE_DESCRIPTORS mode is enabled but connections are restricted to trusted local processes, and (3) at normal schedule if FILE_DESCRIPTORS mode is not in use. The CVSS score of 4.0 reflects the local-only attack vector and requirement for a non-default configuration, but in permissive local environments, availability impact can be severe.

Risk score, explained

The CVSS 3.1 score of 4.0 (MEDIUM) is derived from: Attack Vector Local (AV:L)—requires local presence, Complexity Low (AC:L)—straightforward to execute, Privileges None (PR:N)—no authentication required, User Interaction None (UI:N)—immediate upon receipt, Scope Unchanged (S:U)—impact is limited to the affected process, and Availability impact Low (A:L)—resource exhaustion occurs incrementally. Confidentiality and Integrity are not affected. The score reflects low likelihood in general deployments but does not account for elevated risk in environments where local privilege boundaries are weak or where process restarts are costly.

Frequently asked questions