Executive brief
Netty is a networking library widely used by Java applications to handle network communication. A vulnerability in its Redis protocol decoder component allows a remote attacker to craft malicious Redis messages that force the application to allocate excessive heap memory, crashing the application and causing service unavailability. This impacts any Java application using Netty's RedisDecoder with untrusted network input.
Technical details
The RedisArrayAggregator component in Netty's Redis protocol decoder eagerly preallocates heap memory based on array size headers from RESP (Redis Serialization Protocol) messages without proper validation. A remote attacker can send specially crafted nested RESP array headers with extremely large declared sizes, causing heap exhaustion and denial of service. The vulnerability requires network access but no authentication.
Affected products
- Netty Project Netty <UNKNOWN>
Timeline
- 2026-09-18: disclosed