Executive brief
Netty is a widely used networking framework that helps developers build high-performance servers and clients. A vulnerability in its Redis protocol component allows an attacker to crash the server by sending specially crafted data that consumes all available system memory. This results in a denial-of-service (DoS) condition, making the application unavailable to legitimate users.
Technical details
The RedisDecoder in Netty's Redis codec fails to enforce a maximum length check when decoding bulk strings or array headers. Specifically, the decodeLength method buffers bytes until it encounters a newline character (\n). An attacker can exploit this by opening multiple concurrent connections and sending a continuous stream of digits without the required \r\n terminator. This leads to uncontrolled resource consumption and an OutOfDirectMemoryError, exhausting the server's direct memory pool. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final by implementing bounds on the length prefix.
Affected products
- Netty netty-codec-redis < 4.1.135.Final, >= 4.2.0.Final, <= 4.2.14.Final
Timeline
- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: CVE published to NVD