CVE-2026-45536: Netty: Unix-socket fd receive leaks descriptors when peer sends two at once
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, nettyunixsocketrecvFd sets msgcontrol to char control[CMSGSPACE(sizeof(int))] (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCMRIGHTS cmsg carrying two ints has cmsglen = CMSGLEN(8) = 24, which fits exactly with no MSGCTRUNC, so the kernel installs both fds in the receiving process. The subsequent check cmsg->cmsglen == CMSGLEN(sizeof(int)) (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSGCTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILEDESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Other sources
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, nettyunixsocketrecvFd sets msgcontrol to char control[CMSGSPACE(sizeof(int))] (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCMRIGHTS cmsg carrying two ints has cmsglen = CMSGLEN(8) = 24, which fits exactly with no MSGCTRUNC, so the kernel installs both fds in the receiving process. The subsequent check cmsg-cmsglen == CMSGLEN(sizeof(int)) (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSGCTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILEDESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-transport-native-epollto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
maven/io.netty:netty-transport-native-kqueueto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
maven/io.netty:netty-transport-native-kqueueto a version that resolves this vulnerability.Fixed in 4.2.15.Final - Upgrade
Upgrade
maven/io.netty:netty-transport-native-epollto a version that resolves this vulnerability.Fixed in 4.2.15.Final - Upgrade
Upgrade
nettyto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
nettyto a version that resolves this vulnerability.Fixed in 4.2.15.Final - Compensating control
If using Epoll/KQueue DomainSocketChannel with DomainSocketReadMode.FILE_DESCRIPTORS, avoid receiving file descriptors over Unix sockets until upgrading; otherwise each recvmsg can leak fds when the peer sends two at once.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45536?
CVE-2026-45536 has a medium severity rating of 4.
How do I fix CVE-2026-45536?
To fix CVE-2026-45536, update to the latest version of the Netty transport libraries, specifically netty-transport-native-epoll or netty-transport-native-kqueue.
What type of vulnerability is CVE-2026-45536?
CVE-2026-45536 is categorized as an information leakage vulnerability (CWE-200).
What affected software versions are associated with CVE-2026-45536?
The affected software versions for CVE-2026-45536 include netty-transport-native-epoll and netty-transport-native-kqueue.
What is the impact of CVE-2026-45536?
The impact of CVE-2026-45536 is that it can lead to an information leak due to improper handling of message control data.