CVE-2026-44250

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44250", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T16:33:55.844Z", "datePublished": "2026-06-11T20:49:00.487Z", "dateUpdated": "2026-09-18T12:04:45.558Z"}, "containers": {"cna": {"title": "Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"}, {"name": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "tags": ["x_refsource_MISC"], "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"}, {"name": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "tags": ["x_refsource_MISC"], "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"}], "affected": [{"vendor": "netty", "product": "netty", "versions": [{"version": ">= 4.2.0.Final, < 4.2.15.Final", "status": "affected"}, {"version": "< 4.1.135.Final", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-11T20:49:00.487Z"}, "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "source": {"advisory": "GHSA-3244-j874-rhc2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-12T13:44:38.298945Z", "id": "CVE-2026-44250", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T13:44:45.503Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat Data Grid 8.6.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "netty-codec-redis", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "netty-codec-redis", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "unaffected", "packageName": "netty-codec-redis", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "datePublic": "2026-06-11T20:49:00.487Z", "descriptions": [{"lang": "en", "value": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-44250"}, {"name": "RHBZ#2488062", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44250.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53644"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53645"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53646"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:41951"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:50085"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:37390"}], "solutions": [{"lang": "en", "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"}, {"lang": "en", "value": "RHSA-2026:53645: Red Hat JBoss EAP 7.4 ELS for RHEL 8"}, {"lang": "en", "value": "RHSA-2026:53646: Red Hat JBoss EAP 7.4 ELS for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"}, {"lang": "en", "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"}, {"lang": "en", "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"}], "timeline": [{"lang": "en", "time": "2026-06-11T22:01:16.373Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-11T20:49:00.487Z", "value": "Made public."}], "title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays", "workarounds": [{"lang": "en", "value": "To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-18T12:04:45.558Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "versions": [{"status": "unaffected", "version": "codec-redis", "lessThan": "*", "versionType": "rpm"}], "packageName": "netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "vendor": "Red Hat", "product": "Red Hat Data Grid 8.6.2", "versions": [{"status": "unaffected", "version": "codec-redis", "lessThan": "*", "versionType": "rpm"}], "packageName": "netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "versions": [{"status": "unaffected", "version": "codec-redis", "lessThan": "*", "versionType": "rpm"}], "packageName": "netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_fuse:7"], "vendor": "Red Hat", "product": "Red Hat Fuse 7", "packageName": "netty-codec-redis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "netty-codec-redis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "packageName": "netty-codec-redis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-11T22:01:16.373Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-11T20:49:00.487Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"}, {"lang": "en", "value": "RHSA-2026:53645: Red Hat JBoss EAP 7.4 ELS for RHEL 8"}, {"lang": "en", "value": "RHSA-2026:53646: Red Hat JBoss EAP 7.4 ELS for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"}, {"lang": "en", "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"}, {"lang": "en", "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"}], "x_adpType": "supplier", "datePublic": "2026-06-11T20:49:00.487Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-44250", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062", "name": "RHBZ#2488062", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44250.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53644", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53645", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53646", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:41951", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:50085", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:37390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-18T12:04:45.558Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44250", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T13:44:38.298945Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T13:44:42.022Z"}}], "cna": {"title": "Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays", "source": {"advisory": "GHSA-3244-j874-rhc2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "netty", "product": "netty", "versions": [{"status": "affected", "version": ">= 4.2.0.Final, < 4.2.15.Final"}, {"status": "affected", "version": "< 4.1.135.Final"}]}], "references": [{"url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2", "name": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "name": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "name": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-11T20:49:00.487Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44250", "state": "PUBLISHED", "dateUpdated": "2026-09-18T12:04:45.558Z", "dateReserved": "2026-05-05T16:33:55.844Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-11T20:49:00.487Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "netty", "vendor": "netty", "versions": [{"status": "affected", "version": ">= 4.2.0.Final, < 4.2.15.Final"}, {"status": "affected", "version": "< 4.1.135.Final"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat Data Grid 8.6.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "defaultStatus": "affected", "packageName": "netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "codec-redis", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "netty-codec-redis", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "netty-codec-redis", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "unaffected", "packageName": "netty-codec-redis", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "matchCriteriaId": "3097D962-A32D-4467-AAE7-F4CBA3A349D2", "versionEndExcluding": "4.1.135", "vulnerable": true}, {"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "matchCriteriaId": "413D4611-A46C-4BE4-AB2F-D86282F65984", "versionEndExcluding": "4.2.15", "versionStartIncluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "id": "CVE-2026-44250", "lastModified": "2026-09-18T13:18:24.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44250", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-12T13:44:38.298945Z", "version": "2.0.3"}}]}, "published": "2026-06-11T22:16:56.857", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:37390"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:41951"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:50085"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53644"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53645"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53646"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-44250"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44250.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays", "id": "2488062", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect."}, "name": "CVE-2026-44250", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Affected", "package_name": "netty-codec-redis", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-06-11T20:49:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-44250\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44250\nhttps://github.com/netty/netty/releases/tag/netty-4.1.135.Final\nhttps://github.com/netty/netty/releases/tag/netty-4.2.15.Final\nhttps://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"], "statement": "This is an Important denial of service vulnerability in netty-codec-redis, affecting Red Hat products that process Redis payloads. A remote attacker can exhaust server memory by sending a crafted Redis payload with deeply nested arrays, leading to an OutOfMemoryError and rendering the service unresponsive. This impact is significant due to the potential for complete service disruption without authentication.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.0.Final,4.2.15.Final)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.1.135.Final)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "netty", "source": "cna", "vendor": "netty"}, "product": "netty", "vendor": "netty"}], "created": "2026-06-11T22:45:05.423363+00:00", "updated": "2026-06-15T14:00:12.354380+00:00", "vendors": ["netty", "netty$PRODUCT$netty"]}