CVE-2026-45536

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to char control[CMSG_SPACE(sizeof(int))] (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check cmsg->cmsg_len == CMSG_LEN(sizeof(int)) (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

netty_unix_socket_recvFd sets msg_control to char control[CMSG_SPACE(sizeof(int))] (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check cmsg->cmsg_len == CMSG_LEN(sizeof(int)) (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default).

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-transport-native-kqueue 4.1.100.Final-rhlw-00001 with a backported security fix.

CVE-2026-45536: Netty: Unix-socket fd receive leaks descriptors when peer sends two at once

This patched artifact is a drop-in replacement for io.netty:netty-transport-native-kqueue 4.1.100.Final from Maven Central.

Red Hat Lightwell has released io.netty:netty-transport-native-epoll 4.1.100.Final-rhlw-00001 with a backported security fix.

CVE-2026-45536: Netty: Unix-socket fd receive leaks descriptors when peer sends two at once

This patched artifact is a drop-in replacement for io.netty:netty-transport-native-epoll 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to char control[CMSG_SPACE(sizeof(int))] (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check cmsg->cmsg_len == CMSG_LEN(sizeof(int)) (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 6 CVEs. Fixed in 4.1.130.Final-tuxcare.4.

TuxCare rebuilt 12 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2.

TuxCare rebuilt 12 io.netty packages to address 19 CVEs. Fixed in 4.1.75.Final-tuxcare.5.

TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.93.Final-tuxcare.4.

TuxCare rebuilt 7 io.netty packages to address 11 CVEs. Fixed in 4.1.52.Final-tuxcare.3.

TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.63.Final-tuxcare.7.

TuxCare rebuilt 11 io.netty packages to address 20 CVEs. Fixed in 4.1.73.Final-tuxcare.5.

TuxCare rebuilt 11 io.netty packages to address 18 CVEs. Fixed in 4.1.87.Final-tuxcare.1.

TuxCare rebuilt 9 io.netty packages to address 10 CVEs. Fixed in 4.1.92.Final-tuxcare.6.

TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.115.Final-tuxcare.9.

TuxCare rebuilt 15 io.netty packages to address 27 CVEs. Fixed in 4.1.72.Final-tuxcare.1.

TuxCare rebuilt 43 io.netty packages to address 25 CVEs. Fixed in 4.1.68.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 26 CVEs. Fixed in 4.1.118.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.114.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 17 CVEs. Fixed in 4.2.12.Final-tuxcare.1.

TuxCare rebuilt 10 io.netty packages to address 15 CVEs. Fixed in 4.1.113.Final-tuxcare.1.

TuxCare rebuilt 40 io.netty packages to address 26 CVEs. Fixed in 4.1.53.Final-tuxcare.1.

TuxCare rebuilt 11 io.netty packages to address 21 CVEs. Fixed in 4.1.51.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 6 CVEs. Fixed in 4.1.76.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 16 CVEs. Fixed in 4.2.2.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.74.Final-tuxcare.1.

TuxCare rebuilt 5 io.netty packages to address 4 CVEs. Fixed in 4.1.128.Final-tuxcare.3.

TuxCare rebuilt 43 io.netty packages to address 22 CVEs. Fixed in 4.1.60.Final-tuxcare.3.

TuxCare rebuilt 14 io.netty packages to address 32 CVEs. Fixed in 4.1.64.Final-tuxcare.1.

TuxCare rebuilt 8 io.netty packages to address 8 CVEs. Fixed in 4.1.100.Final-tuxcare.3.

TuxCare rebuilt 7 io.netty packages to address 6 CVEs. Fixed in 4.1.101.Final-tuxcare.3.

TuxCare rebuilt 40 io.netty packages to address 3 CVEs. Fixed in 4.1.49.Final-tuxcare.7.

These are all security issues fixed in the netty-4.1.135-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-45536 in the io.netty:netty-transport-native-epoll package for Root:Maven. Multiple fixed versions available.

This update for netty, netty-tcnative fixes the following issue

This update for netty, netty-tcnative fixes the following issues

Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:

• CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).
• CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).
• CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).
• CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).
• CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).
• CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).
• CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).
• CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).
• CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (bsc#1268250).
• CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).
• CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).
• CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (bsc#1268255).
• CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).
• CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers (bsc#1268258).
• CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).
• CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).
• CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (bsc#1268261).
• CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (bsc#1268262).

Changes:

• MQTT: Allow MQTT 5 CONNECT with password only
• ChannelInitializer: correct misleading comment on exceptionCaught route
• HTTP/2: Parse request-target path like Vert.x (4.1 backport)
• HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
• IpSubnetFilter: Correctly handle ipv6
• Configurable bound on RedisArrayAggregator
• Redis: Limit decoded length
• DNS: Ensure query id is not predictible
• Wrapping plain trust manager silently disables hostname verification
• MQTT: Reject malformed no-payload packets with non-zero Remaining Length
• HAProxy: Reject HAProxyMessages with malformated TLV and not leak memory
• SSL: Use sane defaults as limits for the client hello length and timeout
• DNS: Only cache CNAME if part of the queried domain
• HTTP/2: Enforce max concurrent streams for misbehaving clients
• Dns: Insufficient Bailiwick Validation for NS Records
• HTTP2: DelegatingDecompressorFrameListener must release memory in all cases
• Pass maxAllocation to Brotli and Zstd decoders
• HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory
• Add maxWindowLog parameter to ZstdDecoder to bound memory allocation
• HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs
• Epoll / Kqueue: Correctly handle receive of FD
• SCTP: Limit the number of inflight incomplete SCTP messages and the number of fragments
• Redis: Correctly release incomplete message on removal when using RedisArrayAggregator
• Redis: Limit the maximum number of nested arrays
• HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake
• Marshalling: Explicit document security requirements
• Pin HTTP/RTSP version + method normalization to Locale.US
• Adaptive: Fix concurrency issue in adaptive allocator
• Pin multipart Content-Type / Content-Transfer-Encoding case…