Executive brief
Netty is a popular networking framework used by many Java applications to handle data communication. A vulnerability in its Redis protocol component allows a remote attacker to crash the application or cause a denial-of-service by sending a specially crafted message header. This header forces the system to reserve a massive amount of memory instantly, leading to resource exhaustion and potential service outages.
Technical details
The RedisArrayAggregator in Netty's Redis codec fails to validate the length field in RESP (Redis Serialization Protocol) array headers before memory allocation. When an ArrayHeaderRedisMessage is received, the aggregator instantiates an ArrayList with an initial capacity equal to the declared length without checking against a maximum limit. While the RedisDecoder enforces a maximum length for bulk strings, it does not apply the same restriction to array headers. An attacker can send a small malicious header declaring a massive array size, triggering an immediate large Object array reservation that can lead to an OutOfMemoryError. This vulnerability is patched in versions 4.1.135.Final and 4.2.15.Final.
Affected products
- Netty netty-codec-redis >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final
Timeline
- 2026-06-05: disclosed: Initial disclosure by reporter
- 2026-06-12: advisory: NVD publication date
- 2026-06-15: advisory: GitHub Advisory published