CVE-2026-44250: Netty netty-codec-redis memory exhaustion in RedisArrayAggregator

CVE-2026-44250 · Severity: high · CVSS 7.5 · Published 2026-06-11

Netty is a popular networking framework used by developers to build high-performance servers and clients. A vulnerability in its Redis protocol component allows an attacker to crash the application by sending specially crafted, deeply nested data. This results in a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technologies: io.netty:netty-codec-redis (Maven), Netty Project Codec Redis. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-44250 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44250 being exploited in the wild.
How severe is CVE-2026-44250?
High severity, with a CVSS score of 7.5, published 11 June 2026.
Which products and versions are affected?
io.netty:netty-codec-redis (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final; Netty Project Codec Redis >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final.
Is there a fix for CVE-2026-44250?
Yes. io.netty:netty-codec-redis (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44250 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44250?
Check whether you run io.netty:netty-codec-redis (Maven) or Netty Project Codec Redis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-redis (Maven): upgrade to 4.2.15.Final or later
    # set io.netty:netty-codec-redis to 4.2.15.Final in your pom.xml or build.gradle

Technical details

A vulnerability exists in the RedisArrayAggregator component of netty-codec-redis due to uncontrolled resource consumption (CWE-400). The component uses a Deque to track nested Redis arrays but fails to enforce a maximum depth limit. An unauthenticated remote attacker can send a stream of nested array headers, forcing the server to allocate a massive number of AggregateState objects and ArrayLists. This leads to heap memory exhaustion and an OutOfMemoryError (OOM), resulting in a denial of service. The issue is resolved in versions 4.1.135.Final and 4.2.15.Final by introducing limits on nested array depth.

Affected products

  • Netty Project netty-codec-redis <= 4.1.134.Final, 4.2.0.Final - 4.2.14.Final

Identifiers

  • CVE-2026-44250
  • GHSA-3244-j874-rhc2

Timeline

  • 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
  • 2026-06-05: advisory: GitHub Security Advisory GHSA-3244-j874-rhc2 published
  • 2026-06-11: disclosed: CVE-2026-44250 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.