---
id: CVE-2026-45536
title: >-
  netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of
  Service due to file descriptor leak in SCM_RIGHTS message han…
summary: >-
  A flaw was found in Netty, a network application framework. A local attacker
  could exploit a vulnerability in the `netty_unix_socket_recvFd` function when
  handling `SCM_RIGHTS` messages in `Epoll` or `KQueue DomainSocketChannel` with
  `Doma…
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe:
  - CWE-167
  - CWE-200
  - CWE-772
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - cryostat 4
  - amq_broker 7
  - amq_clients
  - build_of_apache_camel_hawtio 4
  - build_of_apache_camel_4_for_quarkus 3
  - build_of_apache_camel_for_spring_boot 4
  - build_of_debezium 3
  - build_of_keycloak
  - data_grid 8
  - fuse 7
  - jboss_enterprise_application_platform 7
  - jboss_enterprise_application_platform 8
  - jboss_enterprise_application_platform_expansion_pack
  - offline_knowledge_portal
  - openshift_ai_rhoai
  - openshift_dev_spaces
  - single_sign_on 7
  - streams_for_apache_kafka 2
  - streams_for_apache_kafka 3
patched:
  - jboss_enterprise_application_platform 8.1
published: '2026-06-12'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T18:25:23+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45536.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45536.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-45536'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2488394'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-45536'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45536'
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.1.135.Final'
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.2.15.Final'
  - url: 'https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9'
  - url: 'https://access.redhat.com/errata/RHSA-2026:50085'
  - url: 'https://github.com/advisories/GHSA-w573-9ffj-6ff9'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - maven
aliases:
  - GHSA-w573-9ffj-6ff9
ecosystem: maven
ingestedAt: '2026-07-07T15:41:59.856Z'
epss: 0.00136
epssPercentile: 0.02992
---

## Overview

A flaw was found in Netty, a network application framework. A local attacker could exploit a vulnerability in the `netty_unix_socket_recvFd` function when handling `SCM_RIGHTS` messages in `Epoll` or `KQueue DomainSocketChannel` with `DomainSocketReadMode.FILE_DESCRIPTORS` enabled. Incorrect handling of file descriptors could lead to a resource leak, resulting in a Denial of Service (DoS) due to exhaustion of available file descriptors.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Cryostat 4, Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, … · no fix planned: Cryostat 4, Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat build of Apache Camel - HawtIO 4, … · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45536.json)
- **RHSA-2026:50085** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8.1 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50085)

**netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling** — rated Moderate by Red Hat. Released 2026-06-12, updated 2026-09-28.

Affected:

- Cryostat 4
- Red Hat AMQ Broker 7
- Red Hat AMQ Clients
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Debezium 3
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat Single Sign-On 7
- streams for Apache Kafka 2
- streams for Apache Kafka 3

No fix planned:

- Cryostat 4
- Red Hat AMQ Broker 7
- Red Hat AMQ Clients
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Debezium 3
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Fuse 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces
- Red Hat Single Sign-On 7
- streams for Apache Kafka 2
- streams for Apache Kafka 3

Not affected:

- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Satellite 6

## Remediation

Fix deferred

Workarounds / mitigations:

- To mitigate this issue, ensure that `DomainSocketReadMode.FILE_DESCRIPTORS` is not enabled in applications utilizing Netty's `Epoll` or `KQueue DomainSocketChannel`. This feature is not enabled by default, and disabling it prevents the file descriptor leak that could lead to a Denial of Service.

## Package advisory (CVE-2026-45536)

Affected packages:

- `io.netty:netty-transport-native-epoll >= 4.2.0.Final, <= 4.2.14.Final`
- `io.netty:netty-transport-native-kqueue >= 4.2.0.Final, <= 4.2.14.Final`
- `io.netty:netty-transport-native-kqueue <= 4.1.134.Final`
- `io.netty:netty-transport-native-epoll <= 4.1.134.Final`

Patched in:

- `io.netty:netty-transport-native-epoll 4.2.15.Final`
- `io.netty:netty-transport-native-kqueue 4.2.15.Final`
- `io.netty:netty-transport-native-kqueue 4.1.135.Final`
- `io.netty:netty-transport-native-epoll 4.1.135.Final`

Source: https://github.com/advisories/GHSA-w573-9ffj-6ff9