# CVE-2026-44250: Netty netty-codec-redis memory exhaustion in RedisArrayAggregator

Source: https://junglewise.ai/threats/cve-2026-44250-netty-netty-codec-redis-memory-exhaustion-in-redisarrayaggregator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-44250 · Severity: high · CVSS 7.5 · Published 2026-06-11

Netty is a popular networking framework used by developers to build high-performance servers and clients. A vulnerability in its Redis protocol component allows an attacker to crash the application by sending specially crafted, deeply nested data. This results in a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technologies: [io.netty:netty-codec-redis (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-codec-redis), [Netty Project Codec Redis](https://junglewise.ai/threats/technologies/codec-redis). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-44250 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44250 being exploited in the wild.

**How severe is CVE-2026-44250?** High severity, with a CVSS score of 7.5, published 11 June 2026.

**Which products and versions are affected?** io.netty:netty-codec-redis (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final; Netty Project Codec Redis >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final.

**Is there a fix for CVE-2026-44250?** Yes. io.netty:netty-codec-redis (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44250 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44250?** Check whether you run io.netty:netty-codec-redis (Maven) or Netty Project Codec Redis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-codec-redis (Maven): upgrade to 4.2.15.Final or later

  ```sh
  # set io.netty:netty-codec-redis to 4.2.15.Final in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in the RedisArrayAggregator component of netty-codec-redis due to uncontrolled resource consumption (CWE-400). The component uses a Deque to track nested Redis arrays but fails to enforce a maximum depth limit. An unauthenticated remote attacker can send a stream of nested array headers, forcing the server to allocate a massive number of AggregateState objects and ArrayLists. This leads to heap memory exhaustion and an OutOfMemoryError (OOM), resulting in a denial of service. The issue is resolved in versions 4.1.135.Final and 4.2.15.Final by introducing limits on nested array depth.

## Affected products

- Netty Project netty-codec-redis <= 4.1.134.Final, 4.2.0.Final - 4.2.14.Final

## Identifiers

- CVE-2026-44250
- GHSA-3244-j874-rhc2

## Timeline

- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-3244-j874-rhc2 published
- 2026-06-11: disclosed: CVE-2026-44250 published to NVD

## References

- [https://github.com/netty/netty/releases/tag/netty-4.1.135.Final](https://github.com/netty/netty/releases/tag/netty-4.1.135.Final)
- [https://github.com/netty/netty/releases/tag/netty-4.2.15.Final](https://github.com/netty/netty/releases/tag/netty-4.2.15.Final)
- [https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2](https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2)

## Related threats

- [Netty RedisArrayAggregator memory leak in RESP decoding](https://junglewise.ai/threats/cve-2026-56818-netty-redisarrayaggregator-memory-leak-in-resp-decoding)
- [Netty memory exhaustion in RedisArrayAggregator](https://junglewise.ai/threats/cve-2026-50011-netty-memory-exhaustion-in-redisarrayaggregator)
- [Netty memory exhaustion in RedisArrayAggregator](https://junglewise.ai/threats/cve-2026-48006-netty-memory-exhaustion-in-redisarrayaggregator)
- [Netty memory exhaustion in RedisDecoder](https://junglewise.ai/threats/cve-2026-44890-netty-memory-exhaustion-in-redisdecoder)
- [Netty Redis codec CRLF injection in RedisEncoder](https://junglewise.ai/threats/cve-2026-42586-netty-redis-codec-crlf-injection-in-redisencoder)