Vulnerability in Netty
CVE-2026-56818
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but…
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Netty — versions < 4.1.136.Final, >= 4.2.0-Final, < 4.2.16.Final
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-56818?
- CVE-2026-56818 is a medium-severity vulnerability in Netty, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 6.5/10. Published 2026-08-07.
- How severe is CVE-2026-56818?
- Medium severity. CVSS v3 base score is 6.5 out of 10.