CVE-2026-48006
Essential information
- Published
- 12/06/2026 18:16
- Modified
- 12/06/2026 16:18
- Author
- The MITRE Corporation
- Creator
- The MITRE Corporation
- CVSS
- 7.5 HIGH (v3.1) 8.7 HIGH (v4.0)
- CISA KEV
- No
- CWE
- CWE-401
- EPSS (First)
- P13.4% EPSS percentile: rank of this vulnerability versus all others. Higher percentile = more likely to be exploited. Learn more (score 0.00042)
- CVSS vector
-
—
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS metrics
- Access vector
- —
- Access complexity
- —
- Authentication
- —
- Confidentiality impact
- —
- Integrity impact
- —
- Availability impact
- —
- Exploitability
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- None
- Integrity impact
- None
- Availability impact
- High
- Exploit code maturity
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (V)
- None
- Confidentiality (S)
- None
- Integrity (V)
- None
- Integrity (S)
- None
- Availability (V)
- High
- Availability (S)
- None
- Exploit maturity
- NOT_DEFINED
Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
NVD status
- Status
- Undergoing Analysis — CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
- Source
- [email protected]
- NVD
- View on NVD
Affected products (CPE)
| Product | CPE |
|---|---|
| netty / netty | cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* |
| netty / netty | cpe:2.3:a:netty:netty:4.1.135.Final:*:*:*:*:*:*:* |
| netty / netty | cpe:2.3:a:netty:netty:4.2.15.Final:*:*:*:*:*:*:* |