Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
netty netty
>= 4.2.0.Final, < 4.2.15.Finalaffected< 4.1.135.Finalaffected
References
- https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7 ↗
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final ↗
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final ↗
- https://access.redhat.com/security/cve/CVE-2026-50011 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2488413 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50011.json ↗
- https://access.redhat.com/errata/RHSA-2026:53644 ↗
- https://access.redhat.com/errata/RHSA-2026:53645 ↗
- https://access.redhat.com/errata/RHSA-2026:53646 ↗
- https://access.redhat.com/errata/RHSA-2026:41951 ↗
- https://access.redhat.com/errata/RHSA-2026:50085 ↗
- https://access.redhat.com/errata/RHSA-2026:37390 ↗