Executive brief
Netty is a popular networking framework used to build high-performance servers and clients. A vulnerability in its Redis data processing component allows an attacker to send specially crafted messages that cause the system to retain large amounts of data in memory even after an error occurs. This can lead to excessive memory consumption or data corruption if the connection remains open, potentially impacting the stability and reliability of the service.
Technical details
A vulnerability exists in the RedisArrayAggregator component of Netty's Redis codec where the decodeRedisArrayHeader method fails to call releaseAndClearDepths() when a header length exceeds the maxElements limit. While the sibling maxNestedArrayDepth check correctly performs cleanup, the maxElements branch throws a CodecException immediately without releasing retained ByteBuf references. An unauthenticated remote attacker can exploit this by sending a valid RESP array followed by a nested array header that exceeds the limit. If the application does not close the channel upon receiving the exception, the stale aggregate state remains active, pinning pooled buffers and potentially consuming subsequent messages into the corrupted state. Patches are available in versions 4.1.136.Final and 4.2.16.Final.
Affected products
- Netty netty-codec-redis < 4.1.136.Final, >= 4.2.0-Final, < 4.2.16.Final
Timeline
- 2026-08-04: disclosed: Published to netty/netty repository
- 2026-08-07: advisory: GitHub Advisory GHSA-p9jm-q85p-7mcp published