CVE-2026-48748: Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

Vulnerability ID: CVE-2026-48748
CVSS Score: 7.5
Published: 2026-06-15

CVE-2026-48748 is a denial-of-service vulnerability in Netty's HTTP/3 codec (netty-codec-http3) occurring when QPACK dynamic tables are enabled but the blocked streams limit is not explicitly configured. A bug in limit checking and a memory leak in stream tracking allow unauthenticated remote attackers to exhaust the JVM heap memory and crash the server.

TL;DR

A boundary check bypass and memory leak in Netty's HTTP/3 QPACK decoder allow remote attackers to exhaust JVM memory and crash servers via an unrestricted number of blocked streams.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-770
• Attack Vector: Network (AV:N)
• CVSS Score: 7.5
• EPSS Score: 0.00488
• Impact: Availability (Denial of Service via JVM OOM)
• Exploit Status: PoC
• KEV Status: Not Listed

Affected Systems

• io.netty:netty-codec-http3
• Netty HTTP/3-enabled web servers
• API gateways using Netty for HTTP/3
• netty-codec-http3: >= 4.2.0.Final, < 4.2.15.Final (Fixed in: 4.2.15.Final)

Mitigation Strategies

• Upgrade netty-codec-http3 to version 4.2.15.Final or later.
• Manually set HTTP3_SETTINGS_QPACK_BLOCKED_STREAMS to a non-zero limit (e.g., 100) as a temporary workaround.

Remediation Steps:

1. Identify all Maven, Gradle, or other dependency declarations referencing io.netty:netty-codec-http3.
2. Update the version property to 4.2.15.Final or later.
3. If an immediate upgrade is impossible, modify server initialization code to set Http3Settings.withQpackBlockedStreams(100) or equivalent setting in the HTTP/3 bootstrap configuration.
4. Rebuild and redeploy the application.
5. Monitor JVM memory usage and QUIC connection durations to detect anomalies.

References

• GitHub Advisory GHSA-4grm-h2qv-h6w6
• Netty 4.2.15.Final Release Tag
• NVD Vulnerability Page
• CVE Record

Read the full report for CVE-2026-48748 on our website for more details including interactive diagrams and full exploit analysis.