{"id":"CVE-2026-50011","state":"PUBLISHED","title":"Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.","publishedAt":"2026-06-12T14:52:18.042Z","updatedAt":"2026-09-18T12:04:51.521Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["netty netty"],"affected":[{"vendor":"netty","product":"netty","versions":[{"version":">= 4.2.0.Final, < 4.2.15.Final","status":"affected"},{"version":"< 4.1.135.Final","status":"affected"}]}],"references":["https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7","https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://access.redhat.com/security/cve/CVE-2026-50011","https://bugzilla.redhat.com/show_bug.cgi?id=2488413","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50011.json","https://access.redhat.com/errata/RHSA-2026:53644","https://access.redhat.com/errata/RHSA-2026:53645","https://access.redhat.com/errata/RHSA-2026:53646","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:50085","https://access.redhat.com/errata/RHSA-2026:37390"],"weaknesses":["CWE-400","CWE-770"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/50xxx/CVE-2026-50011.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-50011","state":"PUBLISHED","datePublished":"2026-06-12T14:52:18.042Z","dateUpdated":"2026-09-18T12:04:51.521Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-06-02T22:46:02.578Z"},"containers":{"cna":{"title":"Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length","descriptions":[{"lang":"en","value":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}],"affected":[{"vendor":"netty","product":"netty","versions":[{"version":">= 4.2.0.Final, < 4.2.15.Final","status":"affected"},{"version":"< 4.1.135.Final","status":"affected"}]}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7","name":"https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","name":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","tags":["x_refsource_MISC"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","name":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","lang":"en","description":"CWE-400: Uncontrolled Resource Consumption","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-770","lang":"en","description":"CWE-770: Allocation of Resources Without Limits or Throttling","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-06-12T14:52:18.042Z"},"source":{"advisory":"GHSA-5w86-c3rq-vjj7","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-12T15:59:06.922761Z","id":"CVE-2026-50011","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-12T15:59:14.737Z"}},{"title":"netty-codec-redis: Netty: Denial of Service via malicious Redis array header","descriptions":[{"lang":"en","value":"A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity, leading to excessive memory pre-allocation. This can result in a denial of service (DoS) due to resource exhaustion."}],"affected":[{"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16","packageName":"netty","defaultStatus":"affected","versions":[{"version":"codec-redis","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_spring_boot:4.18"]},{"vendor":"Red Hat","product":"Red Hat Data Grid 8.6.2","packageName":"netty","defaultStatus":"affected","versions":[{"version":"codec-redis","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-activemq-artemis","defaultStatus":"affected","versions":[{"version":"0:2.16.0-22.redhat_00057.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-glassfish-jsf","defaultStatus":"affected","versions":[{"version":"0:2.3.14-11.SP11_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-ironjacamar","defaultStatus":"affected","versions":[{"version":"0:1.5.26-2.Final_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-jackson-annotations","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-jackson-core","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-jackson-databind","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-jackson-jaxrs-providers","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-jackson-modules-base","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-jackson-modules-java8","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-jboss-remoting","defaultStatus":"affected","versions":[{"version":"0:5.0.31-3.SP2_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.10.0-46.Final_redhat_00044.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.135-1.Final_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-netty-transport-native-epoll","defaultStatus":"affected","versions":[{"version":"0:4.1.135-1.Final_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-picketlink-bindings","defaultStatus":"affected","versions":[{"version":"0:2.5.5-30.SP12_redhat_00020.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-picketlink-federation","defaultStatus":"affected","versions":[{"version":"0:2.5.5-24.SP12_redhat_00016.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.40-2.SP3_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.25-2.GA_redhat_00001.1.el7eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-activemq-artemis","defaultStatus":"affected","versions":[{"version":"0:2.16.0-22.redhat_00057.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-glassfish-jsf","defaultStatus":"affected","versions":[{"version":"0:2.3.14-11.SP11_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-ironjacamar","defaultStatus":"affected","versions":[{"version":"0:1.5.26-2.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-jackson-annotations","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-jackson-core","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-jackson-databind","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-jackson-jaxrs-providers","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-jackson-modules-base","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-jackson-modules-java8","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-jboss-remoting","defaultStatus":"affected","versions":[{"version":"0:5.0.31-3.SP2_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.10.0-46.Final_redhat_00044.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.135-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-netty-transport-native-epoll","defaultStatus":"affected","versions":[{"version":"0:4.1.135-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-picketlink-bindings","defaultStatus":"affected","versions":[{"version":"0:2.5.5-30.SP12_redhat_00020.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-picketlink-federation","defaultStatus":"affected","versions":[{"version":"0:2.5.5-24.SP12_redhat_00016.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.40-1.SP3_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.25-2.GA_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-activemq-artemis","defaultStatus":"affected","versions":[{"version":"0:2.16.0-22.redhat_00057.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-glassfish-jsf","defaultStatus":"affected","versions":[{"version":"0:2.3.14-11.SP11_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-ironjacamar","defaultStatus":"affected","versions":[{"version":"0:1.5.26-2.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-jackson-annotations","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-jackson-core","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-jackson-databind","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-jackson-jaxrs-providers","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-jackson-modules-base","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-jackson-modules-java8","defaultStatus":"affected","versions":[{"version":"0:2.18.8-1.redhat_00003.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-jboss-remoting","defaultStatus":"affected","versions":[{"version":"0:5.0.31-3.SP2_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-jboss-server-migration","defaultStatus":"affected","versions":[{"version":"0:1.10.0-46.Final_redhat_00044.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-netty","defaultStatus":"affected","versions":[{"version":"0:4.1.135-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-netty-transport-native-epoll","defaultStatus":"affected","versions":[{"version":"0:4.1.135-1.Final_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-picketlink-bindings","defaultStatus":"affected","versions":[{"version":"0:2.5.5-30.SP12_redhat_00020.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-picketlink-federation","defaultStatus":"affected","versions":[{"version":"0:2.5.5-24.SP12_redhat_00016.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-undertow","defaultStatus":"affected","versions":[{"version":"0:2.2.40-1.SP3_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","packageName":"eap7-wildfly","defaultStatus":"affected","versions":[{"version":"0:7.4.25-2.GA_redhat_00001.1.el9eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.1","packageName":"netty","defaultStatus":"affected","versions":[{"version":"codec-redis","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-redis","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"netty-codec-redis","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-redis","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-50011","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488413","name":"RHBZ#2488413","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50011.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50085","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-09-18T12:04:51.521Z"},"datePublic":"2026-06-12T14:52:18.042Z","solutions":[{"lang":"en","value":"RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"},{"lang":"en","value":"RHSA-2026:53645: Red Hat JBoss EAP 7.4 ELS for RHEL 8"},{"lang":"en","value":"RHSA-2026:53646: Red Hat JBoss EAP 7.4 ELS for RHEL 9"},{"lang":"en","value":"RHSA-2026:41951: Red Hat Data Grid 8.6.2"},{"lang":"en","value":"RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"},{"lang":"en","value":"RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"}],"timeline":[{"lang":"en","time":"2026-06-12T16:01:17.003Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-12T14:52:18.042Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"To mitigate this issue, restrict network access to services that utilize the netty-codec-redis component and process Redis traffic. Configure firewalls or network access control lists (ACLs) to limit connections to these services from trusted networks or localhost only. This reduces the attack surface by preventing untrusted remote attackers from sending malicious Redis array headers. Consult product-specific documentation for detailed instructions on configuring network access for affected Red Hat products. Reloading or restarting services may be required for network configuration changes to take effect, which could temporarily impact availability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}