Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Starting in
    version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty
    HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error.
    Version 4.2.15.Final patches the issue. (CVE-2026-48748)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Starting in     version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty     HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error.
    Version 4.2.15.Final patches the issue. (CVE-2026-48748)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465833	Echo: io.netty:netty-codec-http3: security update to 4.2.15.Final	Tenable Cloud Security	Echo Local Security Checks	Local	high
465833	Echo: io.netty:netty-codec-http3: security update to 4.2.15.Final	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
443220	SCA: security update for io.netty:netty-codec-http3 (GHSA-4grm-h2qv-h6w6)	Tenable Cloud Security	SCA Checks	Local	high
443220	SCA: security update for io.netty:netty-codec-http3 (GHSA-4grm-h2qv-h6w6)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
320930	Linux Distros Unpatched Vulnerability : CVE-2026-48748	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-48748

high

Tenable Plugins

high

high

high

high

high