SB2026072404 - Multiple vulnerabilities in Netty
Published: July 24, 2026 Updated: August 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Resource exhaustion (CVE-ID: N/A)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in XmlFrameDecoder. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Missing Release of Resource after Effective Lifetime (CVE-ID: N/A)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to missing release of resource after rffective lifetime in DNS Record Decoder. A remote attacker can cause a denial of service condition on the target system.
3) Memory leak (CVE-ID: CVE-2026-56818)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to retain partial aggregate state and cause integrity and availability impacts.
The vulnerability exists due to improper handling of exceptional conditions in RedisArrayAggregator when processing a RESP array header that exceeds the configured maxElements limit. A remote attacker can send a specially crafted Redis message sequence to retain partial aggregate state and cause integrity and availability impacts.
Exploitation requires the application to keep the channel alive after the decoder exception so that later messages are consumed into the stale aggregate state.
Remediation
Install update from vendor's website.