Homepage

Missing Release of Resource after Effective Lifetime The advisory has been revoked - it doesn't affect any version of package eap7-ironjacamar-core-api  (opens in a new tab)

Threat Intelligence

EPSS
0.75% (55th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-EAP7IRONJACAMARCOREAPI-19949758
  • published19 Sept 2026
  • disclosed12 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 12 Jun 2026

CVE-2026-48043  (opens in a new tab)
CWE-772  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream eap7-ironjacamar-core-api package and not the eap7-ironjacamar-core-api package as distributed by RHEL.

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled ByteBuf handed to an anonymous ChannelInboundHandlerAdapter tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.