CVE-2026-56818

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>netty</name>
	<range><lt>4.1.136</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Netty is an asynchronous, event-driven network application framework.
	Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator
	Redis codec clears retained partial aggregate state when the
	maxNestedArrayDepth limit is exceeded, but it does not clear the same
	state when the sibling maxElements limit is exceeded. A peer can start
	a valid RESP array, send a bulk string child, then send a nested array
	header longer than the configured maxElements. Netty throws a decoder
	exception in decodeRedisArrayHeader, but the existing partial
	aggregate remains retained in the handler. If the application leaves
	the channel alive after the exception, later messages are still
	consumed into the pre-error aggregate, allowing an unauthenticated
	peer to keep attacker-controlled aggregate state alive across a
	security-limit exception and pin retained pooled buffers. This issue
	is fixed in versions 4.1.136.Final and 4.2.16.Final.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-56818</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-56818</url>
    </references>
    <dates>
      <discovery>2026-08-07</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>