Skip to main content

Netty CVE-2026-50011

| EUVDEUVD-2026-36467 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-12 GitHub_M GHSA-5w86-c3rq-vjj7
Denial Of Service Netty
7.5
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify exposed RESP listener
  2. Delivery
    Open TCP connection to Netty service
  3. Exploit
    Send crafted RESP array header with oversized element count
  4. Execution
    RedisArrayAggregator pre-allocates oversized ArrayList
  5. Impact
    JVM heap exhaustion and service outage

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the target to run a Netty pipeline that includes RedisArrayAggregator from io.netty:netty-codec-redis on a network-reachable socket - i.e. a server-side or proxy role that parses inbound RESP traffic from untrusted clients. Once the aggregator is wired into such a pipeline, no authentication, user interaction, or non-default aggregator configuration is required (consistent with AV:N/AC:L/PR:N/UI:N). Exploitation is meaningfully limited in practice because most consumers of netty-codec-redis embed it only as a client connecting to a trusted Redis server, in which case the aggregator never processes attacker-controlled RESP headers.
Impact

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects pure availability impact reachable remotely without authentication or user interaction, which is consistent with a network-facing memory-exhaustion DoS rather than RCE or data loss. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; EPSS was not supplied, so probability of exploitation cannot be quantified. Real-world priority is highest for deployments that expose a Netty-based RESP listener (server or proxy roles) to untrusted networks - exposure is materially lower for the common pattern of using netty-codec-redis only as a client speaking to a trusted Redis server, since the aggregator must actually process attacker-controlled wire bytes to be abused.
Exploit ScenarioDerived

A remote attacker reaches a service that exposes a Netty pipeline including RedisArrayAggregator on a network-reachable socket and sends a single small RESP array header (e.g. '*2147483647\r\n') declaring a near-MAX_INT element count. The aggregator immediately allocates a backing ArrayList sized for that count, exhausting heap and triggering OutOfMemoryError or sustained GC pressure that takes the JVM offline. No public exploit code is identified at time of analysis, but the payload is trivial to construct from the RESP specification.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 12, 2026

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remote attackers to trigger memory exhaustion by sending a crafted RESP array header that declares a huge element count, causing RedisArrayAggregator to pre-allocate an oversized ArrayList before any child messages arrive. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.

RemediationAI

Vendor-released patch: 4.1.135.Final (4.1.x) and 4.2.15.Final (4.2.x) - upgrade io.netty:netty-codec-redis (and the rest of the Netty stack) to the matching branch using the release links above and advisory GHSA-5w86-c3rq-vjj7. If an immediate upgrade is not possible, restrict who can speak RESP to your Netty-based listener by placing it behind an authenticated, network-restricted boundary (firewall/ACL/mTLS) so only trusted peers can submit array headers, accepting reduced reachability and added operational complexity. An application-layer mitigation is to wrap or replace RedisArrayAggregator with a custom decoder that caps the declared element count before delegating, but this is invasive, easy to get wrong, and must be revalidated against future Netty releases, so the patched version is strongly preferred.

Affected VersionsENISA

netty 4.2.0.Final, < 4.2.15.Final
netty < 4.1.135.Final

Affected Packages

maven io.netty:netty-codec-redis fix: 4.1.135.Final, 4.2.15.Final
euvd netty fix: 4.1.135.Final
euvd netty_4_2_0_final fix: 4.2.15.Final

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Netty is a widely deployed asynchronous event-driven Java networking framework used to build protocol servers and clients. The vulnerable code lives in io.netty:netty-codec-redis, specifically RedisArrayAggregator, which parses the Redis RESP (REdis Serialization Protocol) wire format - RESP array messages begin with a header ('*') followed by an integer declaring how many child elements follow. The aggregator reads this number directly off the wire and uses it as the initial capacity for a java.util.ArrayList before any child messages exist on the wire. This is a textbook CWE-400 Uncontrolled Resource Consumption: the allocator trusts an attacker-controlled size from untrusted input, so a tiny header can force a very large up-front allocation regardless of how much data the peer actually intends to send.

Know when Netty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

RESP array header is parsed from a network socket with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); impact is pure availability via heap exhaustion (A:H) with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Patch available
Jun 12, 2026 - 17:01 EUVD

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 76 maven packages depend on io.netty:netty-codec-redis (4 direct, 72 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

Executive ViewAI

Why It Matters

Netty's netty-codec-redis component contains a remote denial-of-service vulnerability (CVE-2026-50011, CVSS 7.5) affecting versions prior to 4.1.135.Final and 4.2.15.Final. Remote attackers can crash or severely degrade services handling Redis protocol traffic by triggering memory exhaustion through crafted network messages. No public exploit identified at time of analysis, but the vulnerability's accessibility warrants prompt remediation.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: Restrict RESP protocol access to trusted sources via firewall rules; implement network-level input validation to reject oversized RESP array headers; apply rate limiting to Redis codec handlers; monitor system memory for abnormal consumption patterns; establish automatic failover procedures for affected services; monitor vendor and CISA advisories for patch availability updates.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-59903 HIGH POC
7.5 Aug 17

Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-50011 ADVISORY https://vuldb.com/vuln/370643 REF https://access.redhat.com/errata/RHSA-2026:37390 REF https://access.redhat.com/errata/RHSA-2026:41951 REF https://access.redhat.com/errata/RHSA-2026:50085 REF https://access.redhat.com/errata/RHSA-2026:53644 REF https://access.redhat.com/errata/RHSA-2026:53645 REF https://access.redhat.com/errata/RHSA-2026:53646 REF https://access.redhat.com/errata/RHSA-2026:53806 REF https://access.redhat.com/security/cve/CVE-2026-50011 REF https://bugzilla.redhat.com/show_bug.cgi?id=2488413 REF https://github.com/netty/netty/releases/tag/netty-4.1.135.Final REF https://github.com/netty/netty/releases/tag/netty-4.2.15.Final REF https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50011.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy