Netty: Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element… (CVE-2026-50011)

Netty, a network application framework, has a vulnerability identified as CVE-2026-50011 affecting versions before 4.1.135.Final and 4.2.15.Final. The RedisArrayAggregator component pre-allocates an ArrayList with an initial capacity equal to the RESP array element count declared in an array header received from the network. Since this count is taken before the child messages exist, a malicious actor can send a small header that claims a huge initial capacity, leading to excessive memory allocation. This flaw can cause denial of service by exhausting system resources. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.

The vulnerability can lead to denial of service (DoS) due to excessive memory allocation when processing maliciously crafted RESP array headers. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 7.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

Upgrade Netty to version 4.1.135.Final or later, or 4.2.15.Final or later, where this vulnerability is patched. No other mitigation is indicated or required.