CVE-2026-50011

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Summary

RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity.

Details

The aggregator starts a new aggregation level when it receives an ArrayHeaderRedisMessage. For positive lengths it pushes AggregateState, whose constructor runs new ArrayList<>(length). No configurable maximum is applied in this handler, and the peer does not need to supply the array elements for the backing array allocation to occur.

In the same pipeline, RedisDecoder enforces RedisConstants.REDIS_MESSAGE_MAX_LENGTH for bulk string lengths but does not apply that cap to array header lengths. Declared array sizes can therefore be extremely large while still passing decoding, and the aggregator immediately attempts Object[] reservation.

io.netty.handler.codec.redis.RedisDecoder#decodeLength io.netty.handler.codec.redis.RedisArrayAggregator#decodeRedisArrayHeader

Impact

Availability / resource exhaustion via unbounded pre-allocation from untrusted RESP array headers.

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-redis 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-42586, CVE-2026-44250, CVE-2026-44890, CVE-2026-48006, CVE-2026-50011, and CVE-2026-56818.

CVE-2026-42586: Netty: CRLF Injection in Netty Redis Codec Encoder

CVE-2026-44250: Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

CVE-2026-44890: Netty has Unbounded Direct Memory Consumption in its RedisDecoder

CVE-2026-48006: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

CVE-2026-50011: Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

CVE-2026-56818: Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

This patched artifact is a drop-in replacement for io.netty:netty-codec-redis 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4.

These are all security issues fixed in the netty-4.1.135-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issue

This update for netty, netty-tcnative fixes the following issues

Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:

• CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).
• CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).
• CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).
• CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).
• CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).
• CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).
• CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).
• CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).
• CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (bsc#1268250).
• CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).
• CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).
• CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (bsc#1268255).
• CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).
• CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers (bsc#1268258).
• CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).
• CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).
• CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (bsc#1268261).
• CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (bsc#1268262).

Changes:

• MQTT: Allow MQTT 5 CONNECT with password only
• ChannelInitializer: correct misleading comment on exceptionCaught route
• HTTP/2: Parse request-target path like Vert.x (4.1 backport)
• HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
• IpSubnetFilter: Correctly handle ipv6
• Configurable bound on RedisArrayAggregator
• Redis: Limit decoded length
• DNS: Ensure query id is not predictible
• Wrapping plain trust manager silently disables hostname verification
• MQTT: Reject malformed no-payload packets with non-zero Remaining Length
• HAProxy: Reject HAProxyMessages with malformated TLV and not leak memory
• SSL: Use sane defaults as limits for the client hello length and timeout
• DNS: Only cache CNAME if part of the queried domain
• HTTP/2: Enforce max concurrent streams for misbehaving clients
• Dns: Insufficient Bailiwick Validation for NS Records
• HTTP2: DelegatingDecompressorFrameListener must release memory in all cases
• Pass maxAllocation to Brotli and Zstd decoders
• HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory
• Add maxWindowLog parameter to ZstdDecoder to bound memory allocation
• HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs
• Epoll / Kqueue: Correctly handle receive of FD
• SCTP: Limit the number of inflight incomplete SCTP messages and the number of fragments
• Redis: Correctly release incomplete message on removal when using RedisArrayAggregator
• Redis: Limit the maximum number of nested arrays
• HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake
• Marshalling: Explicit document security requirements
• Pin HTTP/RTSP version + method normalization to Locale.US
• Adaptive: Fix concurrency issue in adaptive allocator
• Pin multipart Content-Type / Content-Transfer-Encoding case…