Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. In netty-codec-     http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class     orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate     decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each     decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail     handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that     would result in the flow-controller throwing and so trigger a resource leak which at the end might take     down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-48043)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. In netty-codec-
    http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class
    orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate
    decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each
    decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail
    handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that
    would result in the flow-controller throwing and so trigger a resource leak which at the end might take
    down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-48043)

ID	Name	Product	Family	Severity
320927	Linux Distros Unpatched Vulnerability : CVE-2026-48043	Nessus	Misc.	high
443079	SCA: security update for io.netty:netty-codec-http2 (GHSA-c2gf-v879-257j)	Tenable Cloud Security	SCA Checks	high
443079	SCA: security update for io.netty:netty-codec-http2 (GHSA-c2gf-v879-257j)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-48043

high

Tenable Plugins

high

high

high