{"cve":"CVE-2020-11612","nvd":{"published":"2020-04-07T18:15:13.697","modified":"2026-06-17T02:50:28.810","status":"Modified","description":"The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-770"],"references":["https://github.com/netty/netty/compare/netty-4.1.45.Final...netty-4.1.46.Final","https://github.com/netty/netty/issues/6168","https://github.com/netty/netty/pull/9924","https://lists.apache.org/thread.html/r14446ed58208cb6d97b6faa6ebf145f1cf2c70c0886c0c133f4d3b6f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r255ed239e65d0596812362adc474bee96caf7ba042c7ad2f3c62cec7%40%3Cissues.zookeeper.apache.org%3E"],"products":["debian:debian_linux","fedoraproject:fedora","netapp:oncommand_api_services","netapp:oncommand_insight","netapp:oncommand_workflow_automation","netty:netty","oracle:communications_brm_-_elastic_charging_engine","oracle:communications_cloud_native_core_service_communication_proxy","oracle:communications_design_studio","oracle:communications_messaging_server","oracle:nosql_database","oracle:siebel_core_-_server_framework","oracle:webcenter_portal"],"source":"nvd","synced_at":"2026-10-19T21:03:08.679916934+00:00"},"epss":{"cve":"CVE-2020-11612","score":0.09188,"percentile":0.95332,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-mm9x-g8pc-w292","url":"https://osv.dev/vulnerability/GHSA-mm9x-g8pc-w292","summary":"Denial of Service in Netty","modified":"2024-03-14T05:18:47.685399Z","packages":[{"ecosystem":"Maven","name":"io.netty:netty-handler","purl":"pkg:maven/io.netty/netty-handler","ranges":[">=4.1.0 <4.1.46"],"fixed":["4.1.46"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}