CVE-2026-48748: Netty HTTP/3 Memory Exhaustion Vulnerability – Patch to 4.2.15.Final

Technical summary

CVE-2026-48748 is a resource exhaustion vulnerability (CWE-770) in Netty's HTTP/3 codec implementation. The vulnerability allows an unauthenticated remote attacker to send crafted HTTP/3 protocol messages that cause the codec to create and retain blocked streams without proper resource limits or cleanup. This unbounded stream accumulation leads to heap memory exhaustion and out-of-memory (OOM) errors, resulting in application termination. The attack surface is the HTTP/3 protocol handler; any Netty-based service exposing HTTP/3 without rate limiting is at risk. The fix in version 4.2.15.Final implements proper stream lifecycle management and resource constraints.

Business impact

For organizations running Netty-based services—including API gateways, load balancers, messaging systems, and custom protocol servers—this vulnerability directly threatens availability. An attacker can remotely crash production services without authentication, causing service interruption and customer impact. The financial cost includes incident response, service restoration, and reputation damage. Organizations in regulated industries may face compliance violations if availability SLAs are breached. The low complexity and broad network accessibility of the attack make it a practical risk for any exposed Netty HTTP/3 endpoint.

Affected systems

Netty versions before 4.2.15.Final are vulnerable. This includes all 4.2.x versions prior to the patched release, as well as earlier major version lines that support HTTP/3 (version 4.2.0 introduced HTTP/3 support and earlier versions without HTTP/3 are not affected by this specific codec flaw). Any Java application embedding Netty and configured to handle HTTP/3 traffic is at risk. This includes Netty users in microservices, cloud-native deployments, and edge computing environments where HTTP/3 is enabled.

Exploitability

Exploitability is high. The attack requires no authentication, no special privileges, and no user interaction. An attacker needs only network connectivity to the target service and knowledge that it runs an HTTP/3 endpoint—information often easily discoverable via port scanning or service banners. Crafting the malicious HTTP/3 messages is straightforward for an attacker with basic protocol knowledge. No advanced techniques or zero-day exploit code is necessary; the vulnerability can be triggered with standard HTTP/3 client libraries by sending specially crafted protocol frames. Public proof-of-concept demonstrations are likely to emerge if they have not already, lowering the barrier to exploitation.

Remediation

Immediate action: upgrade Netty to version 4.2.15.Final or later. This is the authoritative fix and should be prioritized. For organizations unable to upgrade immediately, implement network-level controls to rate-limit or block HTTP/3 traffic to affected services, or disable HTTP/3 if not operationally required. Monitor application memory usage and implement alerting for OOM conditions. After patching, verify that the upgrade does not break application functionality through testing in a non-production environment first.

Patch guidance

Netty 4.2.15.Final and later contain the patch. Verify your current version using dependency management tools (Maven: check pom.xml; Gradle: check build.gradle). Update the Netty dependency to 4.2.15.Final or the latest stable release in the 4.2.x line or newer major versions if available. Test the upgrade in a staging environment to confirm no breaking changes to your application's HTTP/3 handling or other protocol support. After deployment, monitor application logs and metrics for any anomalies. Establish a process to track Netty security updates going forward, as HTTP/3 support is relatively new and may see additional refinements.

Detection guidance

Monitor for signs of HTTP/3 stream exhaustion: observe connection/stream creation rates, heap memory usage trends, and GC pause times on Netty-based services. Implement alerting on OOM errors and abnormal memory consumption spikes. Network intrusion detection systems (IDS) should flag patterns of rapid HTTP/3 STREAM_ID allocation or abnormally high numbers of concurrent blocked streams if your HTTP/3 implementation logs such metrics. Application Performance Monitoring (APM) tools should be configured to detect memory pressure and service restarts. For forensic investigation, enable Netty debug logging to capture stream lifecycle events, though this should be used selectively due to performance impact.

Why prioritize this

This vulnerability merits HIGH priority remediation. The CVSS 3.1 score of 7.5 reflects a network-accessible denial-of-service condition with no authentication required and impact on availability. While not affecting confidentiality or integrity, service availability is critical for most organizations. The ease of exploitation and broad applicability (any HTTP/3-enabled Netty service) amplify the risk. The patch is available and straightforward to deploy, reducing remediation friction. Organizations should prioritize this within their monthly or immediate patch cycles depending on whether HTTP/3 is actively used in production.

Risk score, explained

CVSS 3.1 base score 7.5 (HIGH) is derived from: Attack Vector: Network (AV:N)—the attack is remotely exploitable; Attack Complexity: Low (AC:L)—no special conditions or timing required; Privileges Required: None (PR:N)—unauthenticated attacker; User Interaction: None (UI:N)—no user action needed; Scope: Unchanged (S:U)—impact is limited to the vulnerable component; Availability Impact: High (A:H)—OOM and service crash are denial of service. Confidentiality and Integrity are Not impacted (C:N, I:N), so the score reflects pure availability loss. This score appropriately captures the practical threat: a trivial remote DoS against any unpatched HTTP/3 service. Note that this vulnerability is not listed in the CISA KEV catalog at this time, indicating it has not yet been observed in active, weaponized exploitation campaigns, though the low barrier to exploitation suggests this status could change.

Frequently asked questions