CVE-2026-44890: Netty memory exhaustion in RedisDecoder

CVE-2026-44890 · Severity: high · CVSS 7.5 · Published 2026-06-11

Netty is a widely used networking framework that helps developers build high-performance servers and clients. A vulnerability in its Redis protocol component allows an attacker to crash the server by sending specially crafted data that consumes all available system memory. This results in a denial-of-service (DoS) condition, making the application unavailable to legitimate users.

Technologies: io.netty:netty-codec-redis (Maven), Netty Project Codec Redis. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-44890 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44890 being exploited in the wild.
How severe is CVE-2026-44890?
High severity, with a CVSS score of 7.5, published 11 June 2026.
Which products and versions are affected?
io.netty:netty-codec-redis (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final; Netty Project Codec Redis >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final.
Is there a fix for CVE-2026-44890?
Yes. io.netty:netty-codec-redis (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44890 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44890?
Check whether you run io.netty:netty-codec-redis (Maven) or Netty Project Codec Redis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-redis (Maven): upgrade to 4.2.15.Final or later
    # set io.netty:netty-codec-redis to 4.2.15.Final in your pom.xml or build.gradle

Technical details

The RedisDecoder in Netty's Redis codec fails to enforce a maximum length check when decoding bulk strings or array headers. Specifically, the decodeLength method buffers bytes until it encounters a newline character (\n). An attacker can exploit this by opening multiple concurrent connections and sending a continuous stream of digits without the required \r\n terminator. This leads to uncontrolled resource consumption and an OutOfDirectMemoryError, exhausting the server's direct memory pool. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final by implementing bounds on the length prefix.

Affected products

  • Netty netty-codec-redis < 4.1.135.Final, >= 4.2.0.Final, <= 4.2.14.Final

Identifiers

  • CVE-2026-44890
  • GHSA-6ghj-frrj-jjj3

Timeline

  • 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
  • 2026-06-05: advisory: GitHub Security Advisory published
  • 2026-06-11: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.