CVE-2026-50011
HIGHNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array length
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-50011. PoCs published by bibotai.
AI-analyzed exploit summary This repository contains a negative proof-of-concept fixture for CVE-2026-50011, demonstrating a non-vulnerable configuration of Netty's Redis pipeline handlers. The code explicitly avoids exploiting the vulnerability and only includes a health endpoint for testing purposes.
Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Exploits (2)
This repository contains a negative proof-of-concept fixture for CVE-2026-50011, demonstrating a non-vulnerable configuration of Netty's Redis pipeline handlers. The code explicitly avoids exploiting the vulnerability and only includes a health endpoint for testing purposes.
This repository provides a proof-of-concept (PoC) for CVE-2026-50011, a vulnerability in Netty's Redis protocol handling (RESP array aggregation). The PoC sets up a vulnerable Netty-based Redis server (version 4.1.133.Final) to demonstrate the issue, which likely involves improper handling of Redis array messages leading to potential memory corruption or DoS.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H