CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2020-11612
High (7.5). EPSS 9.2% chance of exploitation in the next 30 days. Fixed in io.netty:netty-handler 4.1.46.
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Severity
- EPSS
- 9.2% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fedoraproject:fedora
- netapp:oncommand_api_services
- netapp:oncommand_insight
- netapp:oncommand_workflow_automation
- netty:netty
- oracle:communications_brm_-_elastic_charging_engine
- oracle:communications_cloud_native_core_service_communication_proxy
- oracle:communications_design_studio
- oracle:communications_messaging_server
- oracle:nosql_database
- oracle:siebel_core_-_server_framework
- oracle:webcenter_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mm9x-g8pc-w292 | Maven | io.netty:netty-handler | >=4.1.0 <4.1.46 | 4.1.46 |
References
- https://github.com/netty/netty/compare/netty-4.1.45.Final...netty-4.1.46.Final
- https://github.com/netty/netty/issues/6168
- https://github.com/netty/netty/pull/9924
- https://lists.apache.org/thread.html/r14446ed58208cb6d97b6faa6ebf145f1cf2c70c0886c0c133f4d3b6f%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r255ed239e65d0596812362adc474bee96caf7ba042c7ad2f3c62cec7%40%3Cissues.zookeeper.apache.org%3E