What’s Vulnerable › Vulnerabilities
CVE-2020-11612
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 9.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-04-07 · updated 2026-06-17
- Weakness: CWE-770
Description
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Affected products
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 33
- NetApp Oncommand Api Services: all versions
- OnCommand Insight: all versions
- NetApp OnCommand Workflow Automation: all versions
- netty: from 4.1 before 4.1.46 — fixed in 4.1.46
- Oracle Corporation Communications BRM - Elastic Charging Engine: 12.0.0.3
- Oracle Communications Cloud Native Core Service Communication Proxy: 1.5.2
- Oracle Communications Design Studio: 7.4.2
- Oracle Communications Messaging Server: 8.1
- Oracle Nosql Database: before 20.3 — fixed in 20.3
- Oracle Siebel Core - Server Framework: before 21.5 — fixed in 21.5
- Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0, 12.2.1.4.0
How to fix
Upgrade to a fixed version: netty 4.1.46; Oracle Nosql Database 20.3; Oracle Siebel Core - Server Framework 21.5. Check the vendor advisory for mitigations.
References
- https://github.com/netty/netty/compare/netty-4.1.45.Final...netty-4.1.46.Final
- https://github.com/netty/netty/issues/6168
- https://github.com/netty/netty/pull/9924
- https://lists.apache.org/thread.html/r14446ed58208cb6d97b6faa6ebf145f1cf2c70c0886c0c133f4d3b6f%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r255ed239e65d0596812362adc474bee96caf7ba042c7ad2f3c62cec7%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r281882fdf9ea89aac02fd2f92786693a956aac2ce9840cce87c7df6b%40%3Ccommits.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r2958e4d49ee046e1e561e44fdc114a0d2285927501880f15852a9b53%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r31424427cc6d7db46beac481bdeed9a823fc20bb1b9deede38557f71%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r3195127e46c87a680b5d1d3733470f83b886bfd3b890c50df718bed1%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r3ea4918d20d0c1fa26cac74cc7cda001d8990bc43473d062867ef70d%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r4a7e4e23bd84ac24abf30ab5d5edf989c02b555e1eca6a2f28636692%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r4f4a14d6a608db447b725ec2e96c26ac9664d83cd879aa21e2cfeb24%40%3Cnotifications.zookeeper.apache.org%3E
Get alerted when CVE-2020-11612 or the next vulnerability affects your stack