7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50011

CVE-2026-50011: Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50011

CVE-2026-50011:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-redis	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-codec-redis	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an uncontrolled resource consumption issue in Netty's Redis codec, allowing a remote attacker to cause a denial of service. The primary flaw is in the io.netty.handler.codec.redis.RedisArrayAggregator, which pre-allocates an ArrayList based on a size specified in a Redis array header. The decode method of this class processes the malicious message, and before the patch, it did not properly limit the size requested, leading to potentially massive memory allocations and an OutOfMemoryError. The patch introduces a configurable maximum element count to mitigate this. A secondary, related vulnerability was fixed in io.netty.handler.codec.redis.RedisDecoder. Its decode method could be forced to buffer an unreasonable amount of data when parsing a length field because it didn't limit the number of bytes to read for the length. The patch for this adds a size check, providing defense-in-depth against resource exhaustion attacks.

Vulnerable functions

io.netty.handler.codec.redis.RedisArrayAggregator.decode

codec-redis/src/main/java/io/netty/handler/codec/redis/RedisArrayAggregator.java

The `decode` method is the entry point for the `RedisArrayAggregator`. When it receives an `ArrayHeaderRedisMessage`, it calls the private `decodeRedisArrayHeader` method. Prior to the patch, this method would use the length from the message header to prepare for an `ArrayList` allocation. There was no effective limit on this length, allowing a malicious client to specify a very large value, causing an `OutOfMemoryError` upon allocation. The patch introduces a `maxElements` check to prevent this.

io.netty.handler.codec.redis.RedisDecoder.decode

codec-redis/src/main/java/io/netty/handler/codec/redis/RedisDecoder.java

The `decode` method in `RedisDecoder` calls the private `decodeLength` method to parse the length of an incoming Redis element. Before the patch, `decodeLength` did not limit the number of bytes it would read from the input buffer to determine the length. This allowed a malicious client to send a very long string of digits, causing the decoder to buffer an excessive amount of data and consume resources, leading to a denial of service. The patch adds a check to limit the number of bytes read for the length field.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.