CVE-2026-50011: netty Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-50011 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in netty. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 12-06-2026PublishedVulnerability first disclosed.
- 18-09-2026Last modifiedVulnerability information updated.
Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.85%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
+0.39 pp
From 0.46% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard11 products
- celeborn-0.6< 0.6.3-r8
- gremlin-server< 3.8.1-r2
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded) | < 3.5.0-r3
Wolfi4 products
- celeborn-0.6< 0.6.3-r8
- management-api-for-apache-cassandra-5.0< 0.1.120-r0
- thingsboard-tb-mqtt-transport< 4.3.1.2-r13
- thingsboard-tb-node< 4.3.1.2-r13
Debian1 product
- nettyAll versions (No fix recorded)
Io.netty1 product
- netty-codec-redis≥ 4.2.0.Final, < 4.2.15.Final | < 4.1.135.Final
Netty1 product
- netty≥ 4.2.0.Final, < 4.2.15.Final | < 4.1.135.Final | < 4.1.135 | ≥ 4.2.0, < 4.2.15
Ubuntu1 product
- nettyAll versions (No fix recorded)
6 vendors · 19 products
References
19 links- github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
Show all 19 references
- github.com/netty/nettyPACKAGE