CVE-2026-48748

HighCVSS 7.5/10Last modified Aug 4, 2026

Description

Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
nettynetty>= 4.2.0.Final, < 4.2.15.Final
Red HatRed Hat build of Apache Camel - HawtIO 4—

References

Timeline

Published
Jun 12, 2026
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-487499.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/wriCVE-2026-48754.7A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /aCVE-2026-487509.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/execCVE-2026-487519.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevCVE-2026-487529.9Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used toCVE-2026-487539.9Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traveCVE-2026-487542.1Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/CVE-2026-487559.9Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algCVE-2026-487562.1Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/servCVE-2026-487585.4sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/CVE-2026-487597.1TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace CVE-2026-48766.3A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /a
CVE-2026-48748: High severity, CVSS 7.5 | Vulnix