CVE-2020-11612

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Published: Apr 7, 2020
Updated: Nov 8, 2023
CVE: CVE-2020-11612
GHSA: GHSA-mm9x-g8pc-w292
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:N/A:P

CWEs:

Affected Software
References

Software	From	Fixed in
netty / netty	4.1	4.1.46
debian / debian_linux	9.0	9.0.x
debian / debian_linux	10.0	10.0.x
fedoraproject / fedora	33	33.x
oracle / webcenter_portal	12.2.1.3.0	12.2.1.3.0.x
oracle / webcenter_portal	12.2.1.4.0	12.2.1.4.0.x
oracle / nosql_database	-	20.3
oracle / communications_messaging_server	8.1	8.1.x
oracle / communications_design_studio	7.4.2	7.4.2.x
oracle / communications_brm_-_elastic_charging_engine	12.0.0.3	12.0.0.3.x
oracle / communications_cloud_native_core_service_communication_proxy	1.5.2	1.5.2.x
oracle / siebel_core_-_server_framework	-	21.5
io.netty / netty-handler	4.1.0	4.1.46

Vulnerability Database

289,599

CVE-2020-11612