What is the CVSS score of CVE-2026-48748?

CVE-2026-48748 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Netty are affected by CVE-2026-48748?

Netty's HTTP/3 codec (versions prior to 4.2.15.Final) contains a denial-of-service vulnerability allowing remote, unauthenticated attackers to exhaust server memory and trigger service outages.. A patch is available.

Is there a public PoC exploit available for CVE-2026-48748?

Yes, a public proof-of-concept exploit is available for CVE-2026-48748. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-48748?

24 hours: Inventory all deployments of io.netty:netty-codec-http3 and identify which systems expose HTTP/3 endpoints; disable HTTP/3 protocol where operationally feasible to eliminate attack surface. 7 days: Implement per-connection stream limits, rate limiting at application and network layers, and traffic filtering on remaining HTTP/3-enabled services; request patch timeline from Netty maintainers. 30 days: Prepare upgrade to Netty 4.2.15.Final once available; deploy Web Application Firewall rules to detect and block stream-exhaustion attack patterns.

Netty CVE-2026-48748

EUVD-2026-36459 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-12 GitHub_M

GHSA-4grm-h2qv-h6w6

Denial Of Service Netty

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated QUIC peer triggers unbounded allocation causing OOM; availability-only impact, no confidentiality or integrity loss, no user interaction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 12, 2026 - 17:01 EUVD

Source Code Evidence Fetched

Jun 12, 2026 - 16:17 vuln.today

Analysis Generated

Jun 12, 2026 - 16:17 vuln.today

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

AnalysisAI

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote unauthenticated attackers to exhaust server memory by triggering creation of an unbounded number of blocked streams, leading to an OutOfMemoryError. The flaw affects any Java application or service using Netty as an HTTP/3 server. No public exploit identified at time of analysis, and EPSS probability is very low (0.05%, 17th percentile), but the network-reachable nature of the HTTP/3 protocol surface makes patching a priority for exposed endpoints.

Technical ContextAI

Netty is a widely embedded asynchronous event-driven Java network framework used by many JVM-based servers, proxies, and microservice runtimes (e.g., Spring WebFlux, gRPC-Java, Vert.x, Elasticsearch). The vulnerability lives in the HTTP/3 codec, which transports HTTP semantics over QUIC and supports stream flow control. HTTP/3 streams may be 'blocked' (paused) waiting on flow-control credits or QPACK dynamic-table dependencies; the codec failed to bound how many such blocked streams a single connection could accumulate. This maps to CWE-770 (Allocation of Resources Without Limits or Throttling): the resource (stream state objects/buffers) is allocated per peer request with no cap, allowing linear growth of heap consumption until the JVM throws OOM and the process becomes unresponsive or terminates.

RemediationAI

Vendor-released patch: upgrade io.netty:netty-codec-http3 (and aligned Netty modules) to 4.2.15.Final or later, per https://github.com/netty/netty/releases/tag/netty-4.2.15.Final and GHSA-4grm-h2qv-h6w6. If you cannot upgrade immediately, the most effective compensating control is to disable HTTP/3 on the Netty-backed endpoint and continue serving over HTTP/1.1 or HTTP/2 - the trade-off is loss of QUIC's lower-latency and 0-RTT benefits for clients that negotiated h3. Alternatively, place a non-Netty HTTP/3 terminator (e.g., a hardened reverse proxy or load balancer that does not share the bug) in front of the Netty service and have it speak HTTP/2 to the origin, accepting the added hop and operational complexity. Network-level filtering of UDP/443 to untrusted sources can reduce blast radius but breaks legitimate HTTP/3 clients on the public internet.