Homepage

Allocation of Resources Without Limits or Throttling The advisory has been revoked - it doesn't affect any version of package netty-codec-redis  (opens in a new tab)

Threat Intelligence

EPSS
0.85% (57th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-NETTYCODECREDIS-17339272
  • published15 Jun 2026
  • disclosed12 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 12 Jun 2026

CVE-2026-50011  (opens in a new tab)
CWE-770  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream netty-codec-redis package and not the netty-codec-redis package as distributed by RHEL.

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.