Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Prior to
    versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial
    capacity equal to the RESP array element count declared in an array header. That count is taken from the
    wire before the corresponding child messages exist. A small malicious header can claim a huge initial
    capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-50011)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Prior to     versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial     capacity equal to the RESP array element count declared in an array header. That count is taken from the     wire before the corresponding child messages exist. A small malicious header can claim a huge initial     capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-50011)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
443253	SCA: security update for io.netty:netty-codec-redis (GHSA-5w86-c3rq-vjj7)	Tenable Cloud Security	SCA Checks	high
443253	SCA: security update for io.netty:netty-codec-redis (GHSA-5w86-c3rq-vjj7)	Tenable Self-Hosted Container Security	SCA Checks	high
320915	Linux Distros Unpatched Vulnerability : CVE-2026-50011	Nessus	Misc.	high

Detections

Analytics

CVE-2026-50011

high

Tenable Plugins

high

high

high