CVE-2026-50011 Overview
Netty is a network application framework used to build protocol servers and clients across the Java ecosystem. CVE-2026-50011 affects the RedisArrayAggregator component in versions prior to 4.1.135.Final and 4.2.15.Final. The aggregator pre-allocates an ArrayList whose initial capacity is taken directly from the RESP (REdis Serialization Protocol) array header on the wire. An attacker can send a small malicious header that declares a very large element count, forcing the server to reserve a disproportionate amount of memory before any child messages arrive. This resource exhaustion flaw [CWE-400] enables a remote, unauthenticated denial of service against any service decoding untrusted RESP traffic with Netty.
Critical Impact
A single crafted RESP array header can trigger large heap allocations, exhausting memory and producing a denial-of-service condition on Netty-based services.
Affected Products
- Netty netty versions prior to 4.1.135.Final
- Netty netty versions prior to 4.2.15.Final (4.2.x branch)
- Any application or framework embedding the affected netty-codec-redis module
Discovery Timeline
- 2026-06-12 - CVE-2026-50011 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-50011
Vulnerability Analysis
The Redis Serialization Protocol uses an array header that declares the number of subsequent elements. Netty's RedisArrayAggregator reads that count from the wire and uses it as the initialCapacity argument when constructing an ArrayList. Java's ArrayList immediately allocates a backing array of that size. The aggregator performs this allocation before any child elements are read, so the declared count is never compared against the actual number of bytes available on the connection.
An attacker who can deliver bytes to a Netty pipeline containing the Redis codec can send only a few bytes representing a header such as a large positive 32-bit integer. The decoder accepts the value and requests an ArrayList capable of holding hundreds of millions of references. Repeated requests rapidly drive the Java Virtual Machine (JVM) toward OutOfMemoryError, stalling event loops and degrading or crashing the host process.
Root Cause
The root cause is missing input validation on an attacker-controlled length field. The element count is trusted as a sizing hint without bounding it against connection state, available bytes, or a configured maximum. This pattern is a classic uncontrolled resource consumption weakness [CWE-400].
Attack Vector
Exploitation requires network access to a service that decodes RESP traffic using Netty. No authentication and no user interaction are required. The attacker sends a malformed RESP array header declaring an inflated element count and then closes or stalls the connection. The integrity and confidentiality of data are not affected, but availability is.
No public proof-of-concept code is referenced in the advisory. Refer to the GitHub Security Advisory GHSA-5w86-c3rq-vjj7 for vendor technical details.
Detection Methods for CVE-2026-50011
Indicators of Compromise
- Sudden java.lang.OutOfMemoryError: Java heap space events in application logs originating from io.netty.handler.codec.redis stack frames.
- Repeated short-lived TCP connections to Redis-protocol ports followed by abrupt JVM garbage collection pressure or process restarts.
- Spikes in heap allocation rate that correlate with inbound RESP traffic from a small set of source addresses.
Detection Strategies
- Inventory dependencies for netty-codec-redis and any framework that bundles it, then flag versions below 4.1.135.Final or 4.2.15.Final.
- Inspect RESP traffic at the network layer for array headers declaring element counts that exceed realistic application limits.
- Correlate JVM memory telemetry with network flow data to surface allocation spikes triggered by external clients.
Monitoring Recommendations
- Enable JVM heap and garbage collection metrics export and alert on sustained heap usage above operational baselines.
- Forward application and Netty pipeline exception logs to a centralized log platform for query and correlation.
- Track Software Bill of Materials (SBOM) data continuously so that newly disclosed Netty advisories map to running workloads without manual review.
The SentinelOne Singularity Platform can ingest host process telemetry and JVM crash artifacts into the Singularity Data Lake to support investigation of denial-of-service events tied to this vulnerability.
How to Mitigate CVE-2026-50011
Immediate Actions Required
- Upgrade Netty to 4.1.135.Final on the 4.1.x branch or 4.2.15.Final on the 4.2.x branch.
- Identify transitive dependencies pulling in netty-codec-redis and rebuild affected artifacts with the patched version.
- Restrict network exposure of services decoding RESP traffic to trusted clients until patching is complete.
Patch Information
The Netty maintainers released fixes in Netty 4.1.135.Final and Netty 4.2.15.Final. The patched RedisArrayAggregator no longer trusts the wire-supplied count as an allocation hint and bounds initial capacity. Full technical details are documented in the GitHub Security Advisory GHSA-5w86-c3rq-vjj7.
Workarounds
- Place a protocol-aware proxy or firewall in front of Netty services and drop RESP frames whose declared array length exceeds an enforced maximum.
- Apply JVM heap limits and container memory quotas so a single process cannot consume host-wide memory, reducing blast radius until patches deploy.
- Rate-limit and authenticate clients on RESP-decoding endpoints, terminating connections that submit oversized headers.
# Maven dependency override example
mvn dependency:tree | grep netty-codec-redis
# Pin patched version in pom.xml:
# <dependency>
# <groupId>io.netty</groupId>
# <artifactId>netty-codec-redis</artifactId>
# <version>4.1.135.Final</version>
# </dependency>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
