Netty prior 4.1.135.Final/4.2.15.Final MSG_CTRUNC cmsg_len information disclosure

Summaryinfo

A vulnerability was found in Netty. It has been rated as problematic. This affects an unknown function of the component MSG_CTRUNC Handler. Performing a manipulation of the argument cmsg_len results in information disclosure. This vulnerability is reported as CVE-2026-45536. The attack requires a local approach. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Netty. This affects an unknown function of the component MSG_CTRUNC Handler. The manipulation of the argument cmsg_len with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-45536 since 05/12/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 4.1.135.Final or 4.2.15.Final eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1814). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source Netty

Productinfo

Name

• Netty

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion