PT-2026-47555 · Maven · Io.Netty:Netty-Codec-Redis
Published
2026-06-08
·
Updated
2026-06-08
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Summary
An attacker can cause DoS by sending crafted Redis payloads across multiple connections without
r . This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed.Details
io.netty.handler.codec.redis.RedisDecoder decodes the length of bulk strings and array headers using the
decodeLength method. This method reads bytes from the network until it encounters a character. However, it does not enforce any maximum length check while buffering the bytes if the character is not found. An attacker can exploit this by sending a continuous stream of digits (e.g., $1111...) without ever sending a .To cause a true Denial of Service, an attacker must open multiple concurrent connections and distribute the unbounded payloads among them.
According to the RESP specification (https://redis.io/docs/latest/develop/reference/protocol-spec/), all parts of the protocol are strictly terminated with
r . Furthermore, the length prefix itself is an integer representation that must fit within standard numeric limits (e.g., a 64-bit signed integer). Therefore, a stream of digits exceeding these bounds without r is a protocol violation and should be rejected immediately rather than buffered indefinitely.Impact
Denial of Service due to memory exhaustion. Any application using Netty's RedisDecoder to handle untrusted Redis traffic is vulnerable.
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Io.Netty:Netty-Codec-Redis