p PatchFirst

CVE-2020-11612

CVE-2020-11612

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

CVSS 7.5 · High · EPSS 9.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • netty Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-1

    Update to 1:4.1.48-1

  • netty Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-1

    Update to 1:4.1.48-1

  • netty Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-1

    Update to 1:4.1.48-1

  • netty Ubuntu:Pro:14.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
    • 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty Ubuntu:Pro:16.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:4.0.32-1
    • 1:4.0.33-1
    • 1:4.0.34-1
    Affected ranges
    • ECOSYSTEM: < 1:4.0.34-1ubuntu0.1~esm1

    Update to 1:4.0.34-1ubuntu0.1~esm1

  • netty Ubuntu:18.04:LTS

    Versions
    • 1:4.1.7-4
    Affected ranges
    • ECOSYSTEM: < 1:4.1.7-4ubuntu0.1

    Update to 1:4.1.7-4ubuntu0.1

  • netty Ubuntu:Pro:20.04:LTS

    Versions
    • 1:4.1.33-1
    • 1:4.1.33-2
    • 1:4.1.33-3
    • 1:4.1.45-1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.45-1ubuntu0.1~esm1

    Update to 1:4.1.45-1ubuntu0.1~esm1

Original sources

Check your server →