VDB

CVE-2020-11612

CVE-2020-11612 PUBLISHED CVSS 7.5 HIGH

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

EPSS 9.44% · 95.1th percentile

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
9.44%
95.1th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:20.04:LTSnetty1:4.1.33-1, 0, *
Ubuntu:18.04:LTSnetty0, 1:4.1.7-4
Ubuntu:Pro:14.04:LTSnetty1:3.2.6.Final-2, 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1, 0
Ubuntu:Pro:16.04:LTSnetty1:3.2.6.Final-2, *, 0

Timeline

  • Apr 7, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • Jul 4, 2022 EPSS Score
  • Nov 7, 2022 EPSS Score
  • Jan 9, 2023 EPSS Score
  • Mar 12, 2023 EPSS Score
  • Jul 16, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›