Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking → EAGAIN → Java maps to 0 → read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-45536 File Descriptor Leak in Netty Unix Socket Reception Prior to http://4.1.135.Final https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45536
Post summary
The notice briefly discloses a file descriptor leak vulnerability in Netty before version 4.1.135.Final.
🟠 Netty: #Unix-socket fd receive leaks descriptors when peer sends two at once - #CVE-2026-45536 (Moderate) -DC-Jun2026-294 https://dailycve.com/netty-unix-socket-fd-receive-leaks-descriptors-when-peer-sends-two-at-once-cve-2026-45536-moderate-dc-jun2026-294/
Post summary
The tweet announces a moderate‑severity vulnerability in Netty’s Unix socket implementation where file descriptors leak when two frames are sent simultaneously, but provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | netty | netty | - | - | - |