The vulnerability in Netty's Unix‑socket receive function causes a file‑descriptor leak when a peer sends two SCM_RIGHTS control messages at once. The kernel installs both descriptors, but Netty’s length check fails and the branch that would extract and close the descriptors is skipped, leaving two leaked file‑descriptors per message. The leak violates hard‑coded resource‑release expectations (CWE‑772) and presents an inadvertent information exposure that can be abused by a malicious peer to gain access to files or devices the descriptors refer to (CWE‑200).

Netty, the open‑source network application framework, is affected in all 4.1.x releases prior to 4.1.135.Final and in all 4.2.x releases prior to 4.2.15.Final. The flaw is only reachable when the application enables the DomainSocketReadMode.FILE_DESCRIPTORS mode on an Epoll or KQueue DomainSocketChannel and accepts Unix domain socket connections from a peer that can send SCM_RIGHTS messages.

The CVSS score of 4.0 indicates low severity. The EPSS is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploit activity to date. The attack requires a far‑me or local protocol where a malicious peer can connect to the application’s Unix domain socket and send a crafted SCM_RIGHTS message carrying two descriptors. Once the message is processed, the application leaks the descriptors; repeated exploitation could lead to a file‑descriptor exhaustion denial‑of‑service. No privilege escalation or remote code execution is enabled through this flaw, but the risk is notable for long‑running services that do not protect or monitor descriptor counts.