CVE-2020-11612

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.x through 4.1.45

Description The issue is related to the ZlibDecoders class in Netty, which allows for unbounded memory allocation while decoding a ZlibEncoded byte stream. This can be exploited by an attacker to impact the confidentiality, integrity, and availability of protected information by sending a large ZlibEncoded byte stream to the Netty server, forcing it to allocate all of its free memory to a single decoder.

Recommendations For Netty versions 4.1.x through 4.1.45, update to version 4.1.46 or later to resolve the issue. As a temporary workaround, consider restricting the size of incoming ZlibEncoded byte streams to prevent excessive memory allocation.