Skip to content
Fencer Vulns
medium 4.0

CVE-2026-45536 json

Netty: Unix-socket fd receive leaks descriptors when peer sends two at once

published 2026-06-08 5 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-36439 , GHSA-w573-9ffj-6ff9

cvss
4.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Patch / fix

  • maven io.netty:netty-transport-native-epoll 4.1.135.Final, 4.2.15.Final
  • maven io.netty:netty-transport-native-kqueue 4.1.135.Final, 4.2.15.Final
  • io.netty netty-transport-native-epoll 4.1.135.Final, 4.2.15.Final
  • netty netty 4.1.135.Final, 4.2.15.Final
  • io.netty netty-transport-native-kqueue 4.1.135.Final, 4.2.15.Final
  • netty-tcnative SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.0.79-150200.3.45.1
  • netty SLE Module for Package Hub 15 SP7 4.1.135-150200.4.50.1

suse advisories SUSE-SU-2026:2802-1

  • netty openSUSE Tumbleweed 4.1.135-1.1

opensuse advisories openSUSE-SU-2026:11033-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45536 updated cvss 4.0

netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling

  • Red Hat Cryostat 4 netty-transport-native-epoll Red Hat AMQ Broker 7 netty-transport-native-epoll, netty-transport-native-kqueue Red Hat AMQ Clients netty-transport-native-epoll, netty-transport-native-kqueue Red Hat build of Apache Camel - HawtIO 4 netty-transport-native-epoll Red Hat build of Apache Camel 4 for Quarkus 3 netty-transport-native-epoll, netty-transport-native-kqueue Red Hat build of Apache Camel for Spring Boot 4 netty-transport-native-epoll, netty-transport-native-kqueue
    +13 more products
    Red Hat build of Debezium 3 netty-transport-native-epoll, netty-transport-native-kqueue Red Hat Build of Keycloak rhbk/keycloak-rhel9, rhbk-openshift-rhel9, netty-transport-native-epoll Red Hat Data Grid 8 netty-transport-native-epoll, netty-transport-native-kqueue Red Hat Fuse 7 netty-transport-native-epoll, netty-transport-native-kqueue Red Hat JBoss Enterprise Application Platform 7 netty-transport-native-epoll Red Hat JBoss Enterprise Application Platform 8 netty-transport-native-epoll Red Hat JBoss Enterprise Application Platform Expansion Pack netty-transport-native-epoll, netty-transport-native-kqueue Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-openvino-model-server-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-rocm64-torch291-py312-rhel9, +2 more Red Hat OpenShift Dev Spaces devspaces/openvsx-rhel9, devspaces/pluginregistry-rhel9 Red Hat Single Sign-On 7 netty-transport-native-epoll Red Hat streams for Apache Kafka 2 netty-transport-native-epoll Red Hat streams for Apache Kafka 3 netty-transport-native-epoll, netty-transport-native-kqueue
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 bazel6, bazel7, bazel8 Red Hat Satellite 6 candlepin, candlepin-selinux
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
maven io.netty:netty-transport-native-epoll
>=4.2.0.Final, <4.2.15.Final
<4.1.135.Final
4.2.15.Final
4.1.135.Final
maven io.netty:netty-transport-native-kqueue
>=4.2.0.Final, <4.2.15.Final
<4.1.135.Final
4.2.15.Final
4.1.135.Final

Affected products

  • netty netty

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-772 Missing Release of Resource after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.