{"id":"CVE-2026-45536","title":"netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message han…","summary":"A flaw was found in Netty, a network application framework. A local attacker could exploit a vulnerability in the `netty_unix_socket_recvFd` function when handling `SCM_RIGHTS` messages in `Epoll` or `KQueue DomainSocketChannel` with `Doma…","severity":"medium","cvss":4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":["CWE-167","CWE-200","CWE-772"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["cryostat 4","amq_broker 7","amq_clients","build_of_apache_camel_hawtio 4","build_of_apache_camel_4_for_quarkus 3","build_of_apache_camel_for_spring_boot 4","build_of_debezium 3","build_of_keycloak","data_grid 8","fuse 7","jboss_enterprise_application_platform 7","jboss_enterprise_application_platform 8","jboss_enterprise_application_platform_expansion_pack","offline_knowledge_portal","openshift_ai_rhoai","openshift_dev_spaces","single_sign_on 7","streams_for_apache_kafka 2","streams_for_apache_kafka 3"],"patched":["jboss_enterprise_application_platform 8.1"],"published":"2026-06-12","updated":"2026-09-28","sourceUpdated":"2026-09-28T18:25:23+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45536.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45536.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-45536"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488394"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45536"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45536"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"},{"url":"https://access.redhat.com/errata/RHSA-2026:50085"},{"url":"https://github.com/advisories/GHSA-w573-9ffj-6ff9"}],"tags":["csaf","vex","red-hat","ghsa","maven"],"aliases":["GHSA-w573-9ffj-6ff9"],"ecosystem":"maven","ingestedAt":"2026-07-07T15:41:59.856Z","epss":0.00136,"epssPercentile":0.02992,"slug":"CVE-2026-45536","body":"## Overview\n\nA flaw was found in Netty, a network application framework. A local attacker could exploit a vulnerability in the `netty_unix_socket_recvFd` function when handling `SCM_RIGHTS` messages in `Epoll` or `KQueue DomainSocketChannel` with `DomainSocketReadMode.FILE_DESCRIPTORS` enabled. Incorrect handling of file descriptors could lead to a resource leak, resulting in a Denial of Service (DoS) due to exhaustion of available file descriptors.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, … · no fix planned: Cryostat 4, Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat build of Apache Camel - HawtIO 4, … · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45536.json)\n- **RHSA-2026:50085** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8.1 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50085)\n\n**netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling** — rated Moderate by Red Hat. Released 2026-06-12, updated 2026-09-28.\n\nAffected:\n\n- Cryostat 4\n- Red Hat AMQ Broker 7\n- Red Hat AMQ Clients\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Debezium 3\n- Red Hat Build of Keycloak\n- Red Hat Data Grid 8\n- Red Hat Fuse 7\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat Offline Knowledge Portal\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n- streams for Apache Kafka 3\n\nNo fix planned:\n\n- Cryostat 4\n- Red Hat AMQ Broker 7\n- Red Hat AMQ Clients\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat build of Debezium 3\n- Red Hat Build of Keycloak\n- Red Hat Data Grid 8\n- Red Hat Fuse 7\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat Offline Knowledge Portal\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n- streams for Apache Kafka 3\n\nNot affected:\n\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat Satellite 6\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, ensure that `DomainSocketReadMode.FILE_DESCRIPTORS` is not enabled in applications utilizing Netty's `Epoll` or `KQueue DomainSocketChannel`. This feature is not enabled by default, and disabling it prevents the file descriptor leak that could lead to a Denial of Service.\n\n## Package advisory (CVE-2026-45536)\n\nAffected packages:\n\n- `io.netty:netty-transport-native-epoll >= 4.2.0.Final, <= 4.2.14.Final`\n- `io.netty:netty-transport-native-kqueue >= 4.2.0.Final, <= 4.2.14.Final`\n- `io.netty:netty-transport-native-kqueue <= 4.1.134.Final`\n- `io.netty:netty-transport-native-epoll <= 4.1.134.Final`\n\nPatched in:\n\n- `io.netty:netty-transport-native-epoll 4.2.15.Final`\n- `io.netty:netty-transport-native-kqueue 4.2.15.Final`\n- `io.netty:netty-transport-native-kqueue 4.1.135.Final`\n- `io.netty:netty-transport-native-epoll 4.1.135.Final`\n\nSource: https://github.com/advisories/GHSA-w573-9ffj-6ff9","depth":"sunlit","depthScore":22,"depthScoreParts":{"impact":22,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}