Executive brief
Netty is a widely used networking framework for building high-performance Java applications. A flaw in its Redis protocol handler allows remote users to trigger a memory leak by repeatedly opening and closing connections. Over time, this exhausts the server's available memory, leading to a complete service outage for all users.
Technical details
The RedisArrayAggregator handler in Netty's Redis codec fails to implement proper lifecycle cleanup methods (channelInactive, handlerRemoved, or exceptionCaught). When a Redis pipeline connection is terminated before a RESP array aggregate is fully processed, child messages stored in the 'depths' field are never released. These leaked buffers are slices of PooledByteBufAllocator chunks, which prevents the parent chunks from returning to the JVM-wide direct-memory pool. An unauthenticated remote attacker can exploit this by repeatedly initiating and abruptly closing connections, leading to monotonic memory exhaustion and eventual allocation failures across all Netty channels. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.
Affected products
- Netty Project Netty < 4.1.135.Final, >= 4.2.0.Final, <= 4.2.14.Final
Timeline
- 2026-06-02: patched: Release of versions 4.1.135.Final and 4.2.15.Final
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE-2026-48006 published to NVD