CVE-2020-11612: Denial of Service in Netty
Summary
CVE-2020-11612: Denial of Service in Netty. Affects io.netty:netty-handler versions >= 4.1.0, < 4.1.46. Fixed in 4.1.46. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2020-11612 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is io.netty:netty-handler, which is a component of the Netty framework. Netty is a popular open-source networking framework that enables the development of high-performance, scalable, and robust network applications. The netty-handler package specifically provides handlers for various protocols and encoders/decoders. This vulnerability affects versions of Netty 4.1.x before 4.1.46. Netty servers utilizing the ZlibDecoders are susceptible to a Denial of Service (DoS) attack. The ZlibDecoders allow for unbounded memory allocation while decoding a ZlibEncoded byte stream.
Vulnerability Detail
The vulnerability (CVE-2020-11612) arises due to the lack of proper memory allocation checks in the ZlibDecoders of Netty. An attacker can exploit this flaw by sending a large ZlibEncoded byte stream to the Netty server. As a result, the server will allocate all of its free memory to a single decoder, leading to a DoS condition. This can potentially render the server unresponsive and impact its availability. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.46
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the netty-handler package to mitigate the risk of a DoS attack.
Conclusion
In conclusion, the vulnerability (CVE-2020-11612) in the netty-handler package of Netty can lead to a Denial of Service (DoS) attack. It is crucial for developers to upgrade to the fixed version (4.1.46 or later) to mitigate the risk. Regularly monitoring for security updates and promptly applying them is essential for maintaining the security of the application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.netty:netty-handler →
FAQ
Netty is an open-source networking framework that allows the development of high-performance, scalable, and robust network applications.
The netty-handler package is a component of Netty that provides handlers for various protocols and encoders/decoders.
This vulnerability can lead to a Denial of Service (DoS) condition, rendering the Netty server unresponsive and impacting its availability.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
To fix this vulnerability, it is recommended to upgrade the netty-handler package to version 4.1.46 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-handler.
