CVE-2020-11612: Debian Linux

High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days.

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only
• Netapp Oncommand API Services: affected versions not specified
• Netapp Oncommand Insight: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netty Netty: from 4.1, before 4.1.46 (fixed in 4.1.46)
• Oracle Communications Brm - Elastic Charging Engine: version 12.0.0.3 only
• Oracle Communications Cloud Native Core Service Communication Proxy: version 1.5.2 only
• Oracle Communications Design Studio: version 7.4.2 only
• Oracle Communications Messaging Server: version 8.1 only
• Oracle Nosql Database: before 20.3 (fixed in 20.3)
• Oracle Siebel Core - Server Framework: before 21.5 (fixed in 21.5)
• Oracle Webcenter Portal: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2020-04-07. Last modified 2026-06-17.