CVE-2026-48006

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48006", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T17:44:09.585Z", "datePublished": "2026-06-12T14:36:44.416Z", "dateUpdated": "2026-09-18T12:04:45.796Z"}, "containers": {"cna": {"title": "Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator", "problemTypes": [{"descriptions": [{"cweId": "CWE-401", "lang": "en", "description": "CWE-401: Missing Release of Memory after Effective Lifetime", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm"}, {"name": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "tags": ["x_refsource_MISC"], "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"}, {"name": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "tags": ["x_refsource_MISC"], "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"}], "affected": [{"vendor": "netty", "product": "netty", "versions": [{"version": ">= 4.2.0.Final, < 4.2.15.Final", "status": "affected"}, {"version": "< 4.1.135.Final", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T14:36:44.416Z"}, "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "source": {"advisory": "GHSA-6jv9-x5w9-2ccm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-12T16:40:23.259554Z", "id": "CVE-2026-48006", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T16:43:15.426Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat Data Grid 8.6.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "netty-codec-redis", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "netty-codec-redis", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "unaffected", "packageName": "netty-codec-redis", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "datePublic": "2026-06-12T14:36:44.416Z", "descriptions": [{"lang": "en", "value": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-772", "description": "Missing Release of Resource after Effective Lifetime", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-48006"}, {"name": "RHBZ#2488433", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48006.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53644"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53645"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53646"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:41951"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:50085"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:37390"}], "solutions": [{"lang": "en", "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"}, {"lang": "en", "value": "RHSA-2026:53645: Red Hat JBoss EAP 7.4 ELS for RHEL 8"}, {"lang": "en", "value": "RHSA-2026:53646: Red Hat JBoss EAP 7.4 ELS for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"}, {"lang": "en", "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"}, {"lang": "en", "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"}], "timeline": [{"lang": "en", "time": "2026-06-12T16:02:27.195Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-12T14:36:44.416Z", "value": "Made public."}], "title": "netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-18T12:04:45.796Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "versions": [{"status": "unaffected", "version": "codec-redis", "lessThan": "*", "versionType": "rpm"}], "packageName": "netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "vendor": "Red Hat", "product": "Red Hat Data Grid 8.6.2", "versions": [{"status": "unaffected", "version": "codec-redis", "lessThan": "*", "versionType": "rpm"}], "packageName": "netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "versions": [{"status": "unaffected", "version": "codec-redis", "lessThan": "*", "versionType": "rpm"}], "packageName": "netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_fuse:7"], "vendor": "Red Hat", "product": "Red Hat Fuse 7", "packageName": "netty-codec-redis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "netty-codec-redis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "packageName": "netty-codec-redis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-12T16:02:27.195Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-12T14:36:44.416Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"}, {"lang": "en", "value": "RHSA-2026:53645: Red Hat JBoss EAP 7.4 ELS for RHEL 8"}, {"lang": "en", "value": "RHSA-2026:53646: Red Hat JBoss EAP 7.4 ELS for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"}, {"lang": "en", "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"}, {"lang": "en", "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"}], "x_adpType": "supplier", "datePublic": "2026-06-12T14:36:44.416Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-48006", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433", "name": "RHBZ#2488433", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48006.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53644", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53645", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53646", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:41951", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:50085", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:37390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-18T12:04:45.796Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48006", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T16:40:23.259554Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T16:42:48.459Z"}}], "cna": {"title": "Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator", "source": {"advisory": "GHSA-6jv9-x5w9-2ccm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "netty", "product": "netty", "versions": [{"status": "affected", "version": ">= 4.2.0.Final, < 4.2.15.Final"}, {"status": "affected", "version": "< 4.1.135.Final"}]}], "references": [{"url": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm", "name": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "name": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "name": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401: Missing Release of Memory after Effective Lifetime"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T14:36:44.416Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48006", "state": "PUBLISHED", "dateUpdated": "2026-09-18T12:04:45.796Z", "dateReserved": "2026-05-20T17:44:09.585Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T14:36:44.416Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "netty", "vendor": "netty", "versions": [{"status": "affected", "version": ">= 4.2.0.Final, < 4.2.15.Final"}, {"status": "affected", "version": "< 4.1.135.Final"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat Data Grid 8.6.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "netty-codec-redis", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "netty-codec-redis", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "unaffected", "packageName": "netty-codec-redis", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "matchCriteriaId": "3097D962-A32D-4467-AAE7-F4CBA3A349D2", "versionEndExcluding": "4.1.135", "vulnerable": true}, {"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "matchCriteriaId": "413D4611-A46C-4BE4-AB2F-D86282F65984", "versionEndExcluding": "4.2.15", "versionStartIncluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "id": "CVE-2026-48006", "lastModified": "2026-09-18T13:18:29.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48006", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-12T16:40:23.259554Z", "version": "2.0.3"}}]}, "published": "2026-06-12T16:16:30.450", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:37390"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:41951"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:50085"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53644"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53645"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53646"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-48006"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48006.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-772"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator", "id": "2488433", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-48006", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-06-12T14:36:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48006\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48006\nhttps://github.com/netty/netty/releases/tag/netty-4.1.135.Final\nhttps://github.com/netty/netty/releases/tag/netty-4.2.15.Final\nhttps://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm"], "statement": "This is an Important denial of service vulnerability in Netty's RedisArrayAggregator. Repeated connection churn by a network peer can lead to a permanent leak of direct-memory buffers, eventually exhausting the JVM-wide direct-memory pool. This can cause allocation failures across all Netty channels, impacting the availability and stability of Red Hat products utilizing Netty for Redis communication.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.0.Final,4.2.15.Final)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.1.135.Final)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "netty", "source": "cna", "vendor": "netty"}, "product": "netty", "vendor": "netty"}], "created": "2026-06-12T16:30:13.788588+00:00", "updated": "2026-06-15T14:00:12.353000+00:00", "vendors": ["netty", "netty$PRODUCT$netty"]}