Search: CVE-2026-50011

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.5	EPSS 0.5%	CVE-2026-50011Netty · Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element High7.5EPSS 0.5%2026-06-12GCVE DatabaseCVE-2026-50011 Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a vulnerability in RedisArrayAggregator where it pre-allocates an ArrayList with an initial capacity based on a RESP array element count taken from the wire. A maliciously crafted small header can specify a very large initial capacity, potentially causing resource exhaustion. This issue is patched in versions 4.1.135.Final and 4.2.15.Final. EPSS 0.5%Vulnerability	GCVE Database	2026-06-12

Page 1 of 1