PT-2026-47581 · Maven · Io.Netty:Netty-Transport-Native-Epoll+1

Published 2026-06-08 · Updated 2026-06-08

OSV

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

netty unix socket recvFd sets msg control to char control[CMSG SPACE(sizeof(int))] (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM RIGHTS cmsg carrying two ints has cmsg len = CMSG LEN(8) = 24, which fits exactly with no MSG CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check cmsg->cmsg len == CMSG LEN(sizeof(int)) (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE DESCRIPTORS (non-default).

Fix

Missing Release of Resource after Effective Lifetime

Information Disclosure

Weakness Enumeration

CWE-772

CWE-200

Related Identifiers

GHSA-W573-9FFJ-6FF9

Affected Products

Io.Netty:Netty-Transport-Native-Epoll

Io.Netty:Netty-Transport-Native-Kqueue

References · 5

• https://osv.dev/vulnerability/GHSA-w573-9ffj-6ff9 · Vendor Advisory
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9 · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note