CVE-2026-48748: Netty memory exhaustion in HTTP/3 QPACK decoder

CVE-2026-48748 · Severity: high · CVSS 7.5 · Published 2026-06-12

A vulnerability in the Netty networking library's HTTP/3 implementation can allow an attacker to crash a server by exhausting its memory. By sending specifically crafted requests that trigger a flaw in how the server manages data streams, an attacker can force the application to consume all available memory, leading to a complete service outage. This affects any application using Netty's HTTP/3 codec with dynamic tables enabled.

Technologies: io.netty:netty-codec-http3 (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-48748 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48748 being exploited in the wild.
How severe is CVE-2026-48748?
High severity, with a CVSS score of 7.5, published 12 June 2026.
Which products and versions are affected?
io.netty:netty-codec-http3 (Maven) >= 4.2.0.Final, <= 4.2.13.Final, ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final.
Is there a fix for CVE-2026-48748?
Yes. io.netty:netty-codec-http3 (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48748 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48748?
Check whether you run io.netty:netty-codec-http3 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-http3 (Maven): upgrade to 4.2.15.Final or later
    # set io.netty:netty-codec-http3 to 4.2.15.Final in your pom.xml or build.gradle

Technical details

A resource exhaustion vulnerability exists in Netty's `QpackDecoder` due to an improper boundary check in the `shouldWaitForDynamicTableUpdates` method. When `HTTP3_SETTINGS_QPACK_MAX_TABLE_CAPACITY` is enabled but `HTTP3_SETTINGS_QPACK_BLOCKED_STREAMS` is left at its default of 0, a logic error (`blockedStreamsCount == -1`) allows the limit on blocked streams to be bypassed. An attacker can exploit this by sending headers referencing missing table entries, creating an unlimited number of blocked streams that are never removed from memory. This leads to a Java Virtual Machine (JVM) Out of Memory (OOM) error and a Denial of Service (DoS). The issue is fixed in version 4.2.15.Final.

Affected products

  • Netty netty-codec-http3 >= 4.2.0.Final, <= 4.2.13.Final

Identifiers

  • CVE-2026-48748
  • GHSA-4grm-h2qv-h6w6

Timeline

  • 2026-06-05: disclosed: Initial disclosure on GitHub
  • 2026-06-12: advisory: NVD publication date
  • 2026-06-15: advisory: GitHub Advisory Database publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.