Executive brief
Netty is a popular networking framework used by developers to build high-performance servers and clients. A vulnerability in its Redis protocol component allows an attacker to crash the application by sending specially crafted, deeply nested data. This results in a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.
Technical details
A vulnerability exists in the RedisArrayAggregator component of netty-codec-redis due to uncontrolled resource consumption (CWE-400). The component uses a Deque to track nested Redis arrays but fails to enforce a maximum depth limit. An unauthenticated remote attacker can send a stream of nested array headers, forcing the server to allocate a massive number of AggregateState objects and ArrayLists. This leads to heap memory exhaustion and an OutOfMemoryError (OOM), resulting in a denial of service. The issue is resolved in versions 4.1.135.Final and 4.2.15.Final by introducing limits on nested array depth.
Affected products
- Netty Project netty-codec-redis <= 4.1.134.Final, 4.2.0.Final - 4.2.14.Final
Timeline
- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-3244-j874-rhc2 published
- 2026-06-11: disclosed: CVE-2026-44250 published to NVD