CVE-2026-48043
ADVISORY - githubSummary
Impact
The DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled ByteBuf handed to an anonymous ChannelInboundHandlerAdapter tail handler, which becomes the sole owner responsible for releasing it.
A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME.
Common Weakness Enumeration (CWE)
Missing Release of Resource after Effective Lifetime
NIST
CVSS SCORE
5.3mediumGitHub
CVSS SCORE
5.3mediumDebian
-
Ubuntu
3.9
CVSS SCORE
7.5mediumRed Hat
3.9
CVSS SCORE
7.5highChainguard
CGA-q8m8-3ppv-93jj
-
minimos
MINI-24qg-7grm-795q
-
minimos
MINI-2c52-84cf-2frr
-
minimos
MINI-2crq-5wr7-j6rc
-
minimos
MINI-2v86-6mwq-qj5h
-
minimos
MINI-2wmm-4xx2-39mh
-
minimos
MINI-34rp-cfrg-9w6h
-
minimos
MINI-3fgm-5369-9j5x
-
minimos
MINI-3p9p-97xq-2p86
-
minimos
MINI-3vpq-2pgj-hccx
-
minimos
MINI-4gfm-qcq7-96w4
-
minimos
MINI-4rcr-2mvc-h876
-
minimos
MINI-57m6-w5c4-9frr
-
minimos
MINI-5jrg-5h5v-wjv7
-
minimos
MINI-63hr-p84g-c7pq
-
minimos
MINI-68v9-vwx6-5qf3
-
minimos
MINI-6q8m-88qh-w48x
-
minimos
MINI-6wgq-8xvj-2jc5
-
minimos
MINI-77hh-56q6-2628
-
minimos
MINI-77vx-jx8w-x5f7
-
minimos
MINI-7f9j-hpwg-qf3w
-
minimos
MINI-7mcj-f87c-qmm6
-
minimos
MINI-8q4v-wfqw-wmqm
-
minimos
MINI-8q9q-gv7v-qp6c
-
minimos
MINI-8r5r-78x2-m2j9
-
minimos
MINI-9454-f86j-p2rc
-
minimos
MINI-97v7-7rjf-7fqh
-
minimos
MINI-9q2w-jh2r-8mr3
-
minimos
MINI-c3wh-3fqq-xj2m
-
minimos
MINI-c5cg-cx46-qfg3
-
minimos
MINI-c8cf-7gxv-hgc2
-
minimos
MINI-cc22-4xvq-f3vf
-
minimos
MINI-cg89-vh7h-v25h
-
minimos
MINI-cxwx-h3pr-pq4j
-
minimos
MINI-f4g4-74hj-gcf5
-
minimos
MINI-f534-cvgc-hcx9
-
minimos
MINI-fc66-7q3f-9g85
-
minimos
MINI-fvc3-29qw-4h6c
-
minimos
MINI-fwrf-4h7v-8fv8
-
minimos
MINI-fx73-m9g6-hcrf
-
minimos
MINI-g2qp-53rp-2w65
-
minimos
MINI-gc5x-66x7-xgmc
-
minimos
MINI-gjh8-vrm2-8vvj
-
minimos
MINI-gmvv-5hhx-g827
-
minimos
MINI-h3qh-vx4g-xx42
-
minimos
MINI-hm4h-vqg6-q3g5
-
minimos
MINI-hq2p-6hxc-wppg
-
minimos
MINI-j352-vwcg-2wqh
-
minimos
MINI-jpv5-j4vx-x2wc
-
minimos
MINI-jvwj-pmrm-pxhw
-
minimos
MINI-m3r8-f6hx-8phj
-
minimos
MINI-mq3c-x397-6cq5
-
minimos
MINI-p7r2-85pm-457m
-
minimos
MINI-pc5q-m32m-xhh6
-
minimos
MINI-pgg6-q9cm-w89f
-
minimos
MINI-q2c3-5cr2-g6q7
-
minimos
MINI-q7f4-5gg6-75rw
-
minimos
MINI-q874-v444-7jgq
-
minimos
MINI-qj9m-r37m-p257
-
minimos
MINI-rm7g-qxr8-r553
-
minimos
MINI-vgx5-v4m2-6rpm
-
minimos
MINI-vrrm-4w32-mpjf
-
minimos
MINI-w4mg-547j-2739
-
minimos
MINI-w898-cmvm-2f24
-
minimos
MINI-wv68-c4w9-cvjv
-
minimos
MINI-wwfh-67vp-mgrh
-
minimos
MINI-x822-jgpx-x88x
-
minimos
MINI-x8cv-283p-6g5p
-
minimos
MINI-x9vr-v7g7-6f7q
-
minimos
MINI-xc7c-gg9m-wp3g
-
minimos
MINI-xr72-4jxm-mg5j
-
minimos
MINI-xrc2-qrjc-q264
-
minimos
MINI-xrr2-g973-33q6
-
minimos
MINI-xx9f-g688-p765
-
minimos
MINI-xxg9-5333-p269
-