Loading vulnerability…
Netty Unix-domain socket file descriptor leak
CVE-2026-45536 is a file descriptor leak in Netty's native epoll and kqueue transports, affecting the 4.1 and 4.2 branches before 4.1.135.Final and 4.2.15.Final, respectively. The netty_unix_socket_recvFd function allocates an ancillary-data buffer sized with CMSG_SPACE(sizeof(int)). On 64-bit Linux, alignment allows an SCM_RIGHTS control message containing two file descriptors to fit in this buffer without truncation. The kernel installs both descriptors, but Netty's strict check for a control-message length corresponding to one descriptor rejects the message without closing either descriptor. Each crafted message therefore leaks two descriptors. The implementation also lacks MSG_CTRUNC handling. Exploitation requires an Epoll/KQueue DomainSocketChannel configured with the non-default DomainSocketReadMode.FILE_DESCRIPTORS setting and can cause resource exhaustion and denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Repeated crafted SCM_RIGHTS messages can exhaust the receiving process's file descriptor limit, preventing it from opening files, accepting connections, or performing other descriptor-dependent operations. The result is service degradation or denial of service. No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
Avoid enabling DomainSocketReadMode.FILE_DESCRIPTORS until patched, where application functionality permits. Restrict access to affected Unix-domain socket endpoints to trusted local peers and monitor the receiving process for abnormal file descriptor growth.
Patch, then assume compromise.
Upgrade io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue to 4.1.135.Final or later in the 4.1 branch, or 4.2.15.Final or later in the 4.2 branch. For products bundling Netty, apply the vendor-supported release incorporating the corrected native transport packages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.