CVE-2026-48748: Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

Synopsis

Memory exhaustion vulnerability in the Netty HTTP/3 QPACK codec (versions 4.2.0.Final through 4.2.14.Final) allows an attacker to create an unbounded number of blocked streams. The vulnerability is reachable over the network with no authentication required and no victim interaction needed. Successful exploitation causes the affected process to run out of memory, crashing or making the service unavailable. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable HTTP/3 codec endpoint must be reachable over the network; an attacker sends crafted QPACK-encoded requests from any internet-accessible or internal network path.

• AuthenticationNot required

  No credentials or account are needed; the attacker can trigger stream creation as an unauthenticated client.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no user or administrator action is required to trigger the memory exhaustion.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• The affected Netty process exhausts heap memory, causing an OutOfMemoryError that crashes the JVM or renders the service completely unresponsive.
• All HTTP/3 traffic handled by the affected service is disrupted for the duration of the attack, impacting every client connected through that endpoint.
• Downstream services or components that depend on the affected Netty-based service lose connectivity, potentially cascading failures across dependent workloads.