Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-50011Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

High 7.5

In plain English

A high-severity uncontrolled resource consumption in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-50011
Debian:13nettyno fix listedDEBIAN-CVE-2026-50011
Debian:14nettyno fix listedDEBIAN-CVE-2026-50011
Mavenio.netty:netty-codec-redis4.1.135.FinalGHSA-5w86-c3rq-vjj7
Mavenio.netty:netty-codec-redis4.2.15.FinalGHSA-5w86-c3rq-vjj7
Ubuntu:25.10nettyno fix listedUBUNTU-CVE-2026-50011
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-50011

Affected products (as reported)

VendorProductVersions
netty netty >= 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final

Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References