High severity7.5NVD Advisory· Published Jun 12, 2026· Updated Sep 9, 2026
CVE-2026-50011
CVE-2026-50011
Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.netty:netty-codec-redisMaven | >= 4.2.0.Final, < 4.2.15.Final | 4.2.15.Final |
io.netty:netty-codec-redisMaven | < 4.1.135.Final | 4.1.135.Final |
Affected products
15- osv-coords12 versionspkg:rpm/opensuse/netty&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/wolfi/celeborn-0.6pkg:apk/chainguard/gremlin-serverpkg:apk/chainguard/celeborn-0.6pkg:apk/chainguard/pinot-fipspkg:apk/chainguard/thingsboard-tb-mqtt-transportpkg:apk/wolfi/management-api-for-apache-cassandra-5.0pkg:apk/wolfi/thingsboard-tb-nodepkg:apk/chainguard/management-api-for-apache-cassandra-5.0pkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:apk/chainguard/seata-server
< 4.1.135-1.1+ 11 more
- (no CPE)range: < 4.1.135-1.1
- (no CPE)range: < 4.3.1.2-r13
- (no CPE)range: < 0.6.3-r8
- (no CPE)range: < 3.8.1-r2
- (no CPE)range: < 0.6.3-r8
- (no CPE)range: < 1.5.0-r11
- (no CPE)range: < 4.3.1.2-r13
- (no CPE)range: < 0.1.120-r0
- (no CPE)range: < 4.3.1.2-r13
- (no CPE)range: < 0.1.120-r0
- (no CPE)range: < 4.3.1.2-r13
- (no CPE)range: < 2.7.0-r3
Patches
Vulnerability mechanics
References
13- github.com/advisories/GHSA-5w86-c3rq-vjj7ghsaADVISORY
- github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-50011ghsaADVISORY
- github.com/netty/netty/releases/tag/netty-4.1.135.FinalnvdRelease NotesWEB
- github.com/netty/netty/releases/tag/netty-4.2.15.FinalnvdRelease NotesWEB
- access.redhat.com/errata/RHSA-2026:37390nvd
- access.redhat.com/errata/RHSA-2026:41951nvd
- access.redhat.com/errata/RHSA-2026:50085nvd
- access.redhat.com/errata/RHSA-2026:53644nvd
- access.redhat.com/errata/RHSA-2026:53806nvd
- access.redhat.com/security/cve/CVE-2026-50011nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50011.jsonnvd
News mentions
0No linked articles in our index yet.