{"vulnerability": "cve-2026-5681", "sightings": [{"uuid": "7db2b090-6114-497f-ba82-6718c6a90366", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-56819", "type": "published-proof-of-concept", "source": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972", "content": "", "creation_timestamp": "2026-07-31T18:35:17.174213Z"}, {"uuid": "e8b4da5e-3550-4362-923a-0e5495fa7feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56818", "type": "seen", "source": "https://gist.github.com/alon710/8c320d44f4f97b648e1d03dded62d53e", "content": "# CVE-2026-56818: CVE-2026-56818: Denial of Service via Memory Pinning in Netty Redis Array Aggregator\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56818\n\n## Summary\nA vulnerability in Netty's Redis codec allows remote unauthenticated attackers to cause a memory-pinning Denial of Service (DoS) due to the failure to release partial aggregate state when specific error conditions occur in RedisArrayAggregator. When processing Redis Serialization Protocol (RESP) messages, the aggregator fails to clear internal queues and release retained direct byte buffers on exception paths triggered by exceeded maxElements or invalid length properties. If the pipeline does not explicitly tear down the connection upon detecting a decoder error, subsequent elements continue utilizing the stale context, allowing memory blocks to remain indefinitely pinned.\n\n## TL;DR\nNetty's Redis array aggregator fails to release pooled direct buffers upon specific limit-validation errors, allowing remote attackers to pin system memory and induce a Denial of Service.\n\n## Technical Details\n\n- **CWE ID**: CWE-401, CWE-703\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 6.5\n- **Impact Type**: Denial of Service (Memory Exhaustion)\n- **Exploit Status**: No public PoC available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Servers running Netty with Redis Serialization Protocol aggregation enabled\n- **Netty**: < 4.1.136.Final (Fixed in: `4.1.136.Final`)\n- **Netty**: >= 4.2.0-Final, < 4.2.16.Final (Fixed in: `4.2.16.Final`)\n\n## Mitigation\n\n- Upgrade Netty to safe version releases\n- Implement strict channel teardown upon detecting codec errors\n- Monitor direct buffer allocator telemetry\n\n**Remediation Steps:**\n1. Identify and update all netty-codec-redis dependencies to 4.1.136.Final or 4.2.16.Final\n2. Configure exception caught handlers in the channel pipeline to force-close connections on decoderexceptions\n3. Audit application dependencies to ensure no legacy transitive Netty packages remain active\n\n## References\n\n- [GitHub Security Advisory GHSA-p9jm-q85p-7mcp](https://github.com/netty/netty/security/advisories/GHSA-p9jm-q85p-7mcp)\n- [Netty Pull Request 17065](https://github.com/netty/netty/pull/17065)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56818) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T18:31:18.171975Z"}, {"uuid": "289ca3d9-bee8-4ede-a0c5-069d78d29e89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-56818", "type": "published-proof-of-concept", "source": "https://github.com/netty/netty/security/advisories/GHSA-p9jm-q85p-7mcp", "content": "", "creation_timestamp": "2026-08-07T18:35:07.406055Z"}, {"uuid": "086f8243-92f7-4a12-8b1a-1ac3eeaa0cd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56819", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3msq6vheark2o", "content": "\ud83d\udd17 CVE : CVE-2018-11798, CVE-2019-0205, CVE-2020-13949, CVE-2026-43869, CVE-2026-45205, CVE-2026-54291, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-56819, CVE-2026-59898, CVE-2026-59899, CVE-2026-59900, CVE-2026-59901, CVE-2026-59921", "creation_timestamp": "2026-08-10T13:20:13.828686Z"}, {"uuid": "bb77d6ee-bb88-4b09-8d0d-d95844fc7376", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56815", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxt6vyz4g2t", "content": "CVE-2026-56815 - Pwnlift Symlink Following Vulnerability\nCVE ID : CVE-2026-56815\n \n Published : June 23, 2026, 1:57 p.m. | 1\u00a0hour, 46\u00a0minutes ago\n \n Description : pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handl...", "creation_timestamp": "2026-06-23T16:31:17.332805Z"}, {"uuid": "76d42e7e-2c1c-4af4-8a4f-b0eff7c41c62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56815", "type": "seen", "source": "https://bsky.app/profile/payloadforge.io/post/3moydyj6t6s2m", "content": "Thanks - MITRE assigned CVE-2026-56815 today, same day the oss-security post went live. The blank ID field lasted 53 days and two CNA rejections. Apparently the fix for process friction is publishing without one.", "creation_timestamp": "2026-06-23T21:31:57.867501Z"}, {"uuid": "97bb23c6-dfff-4668-8273-deb4ad808a88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56815", "type": "seen", "source": "https://bsky.app/profile/r-redteamsec.bsky.social/post/3mozte4uvvb2k", "content": "From CRTO lab finding to CVE-2026-56815", "creation_timestamp": "2026-06-24T11:39:31.685434Z"}, {"uuid": "b0860996-34f6-4744-9b57-23d8dca6cc4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-56819", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0991", "content": "", "creation_timestamp": "2026-08-13T08:46:42.776331Z"}, {"uuid": "6300effa-6d15-4fd8-a8a5-b55d39e0a7f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56810", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpy2wscgqc2s", "content": "CVE-2026-56810 - mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5\nCVE ID : CVE-2026-56810\n \n Published : July 6, 2026, 11:16 a.m. | 31\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Throttling vulnerability in elixir-m...", "creation_timestamp": "2026-07-06T12:15:10.729462Z"}, {"uuid": "34ee21d4-dbe4-4bd3-9dd6-3104abfaba3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56811", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq3dokzdvm2f", "content": "CVE-2026-56811 - Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service\nCVE ID : CVE-2026-56811\n \n Published : July 7, 2026, 4:16 p.m. | 2\u00a0hours, 58\u00a0minutes ago\n \n Description : Allocation of Resources Without Limits or Thro...", "creation_timestamp": "2026-07-07T19:29:33.257854Z"}, {"uuid": "9f5e2b88-5ecc-4e07-adc5-83d0c3c8999d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56811", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqbqmo6rwy2l", "content": "\ud83d\udccc CVE-2026-56811 - Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attac... https://www.cyberhub.blog/cves/CVE-2026-56811", "creation_timestamp": "2026-07-10T08:37:06.830721Z"}, {"uuid": "2777ad96-0a11-43be-8800-cff0b82b254b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56814", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqclt7fdnp27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56814 \u0432 Plug.Parsers.MULTIPART: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0444\u0430\u0439\u043b\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/A2109129-CE1A-4D22-950D-2FF4897FCC9B", "creation_timestamp": "2026-07-10T16:43:56.866906Z"}, {"uuid": "c84e6dfe-63c7-40a5-b9c7-ee5e5821ce67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56813", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcp6v44l32e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56813 \u0432 Elixir: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/95F5448A-BBFD-48F2-94D1-D8E3260DFF27", "creation_timestamp": "2026-07-10T17:44:10.200145Z"}, {"uuid": "03c1bf62-70a3-4a3b-9b6d-d4ac9c91c922", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56813", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd4zxcvbj2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-56813 \u0432 Elixir: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/9164FF66-4E36-4150-9A0E-B050F2551EEB", "creation_timestamp": "2026-07-10T21:51:57.054062Z"}, {"uuid": "c2cefc9b-8d03-42f5-84dc-94e092bbbabe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56819", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr74onri4f2m", "content": "\ud83d\udfe0 CVE-2026-56819 - High (7.5)\n\nNetty is a network application framework for development of protocol servers and clients. In vers...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-56819/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-22T01:00:11.339325Z"}, {"uuid": "c58b727f-dfe7-4eef-b906-fa7c6b1db063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56817", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr7am2pn732e", "content": "CVE-2026-56817 - Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled\nCVE ID : CVE-2026-56817\n \n Published : July 21, 2026, 11:17 p.m. | 1\u00a0hour, 18\u00a0minutes ago\n \n Description : Netty is a network application framewo...", "creation_timestamp": "2026-07-22T02:10:18.876893Z"}, {"uuid": "86595d23-f215-4866-9158-2e51c6de10fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56819", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr7cf3wyvf23", "content": "CVE-2026-56819 - Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)\nCVE ID : CVE-2026-56819\n \n Published : July 21, 2026, 11:17 p.m. | 2\u00a0hours, 27\u00a0minutes ago\n \n Description : Netty is a netw...", "creation_timestamp": "2026-07-22T02:42:12.240698Z"}, {"uuid": "80eab5e5-6e28-40ff-9e99-e88dbe9c2865", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-56816", "type": "published-proof-of-concept", "source": "https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv", "content": "", "creation_timestamp": "2026-07-22T22:35:17.560022Z"}, {"uuid": "76e101a1-4a80-4245-a9d0-da93ec2bf0ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56819", "type": "seen", "source": "https://t.me/bdufstecru/3345", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u043a\u043e\u043c\u043f\u0440\u0435\u0441\u0441\u0438\u0438 Http2Decompressor.decompress \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 Netty \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-10489\nCVE-2026-56819\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972", "creation_timestamp": "2026-07-27T16:00:06.226673Z"}, {"uuid": "92adc2a0-5163-44de-a04a-59c9b1bc3e41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56819", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3345", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u043a\u043e\u043c\u043f\u0440\u0435\u0441\u0441\u0438\u0438 Http2Decompressor.decompress \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 Netty \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-10489\nCVE-2026-56819\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972", "creation_timestamp": "2026-07-28T00:00:32.008079Z"}]}