PT-2026-47601 · Unknown · Netty-Codec-Redis

Published 2026-06-08 · Updated 2026-06-11 · CVE-2026-44250

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions netty-codec-redis versions prior to 4.1.135.Final netty-codec-redis versions prior to 4.2.15.Final

Description A denial of service can occur when an attacker sends a crafted Redis payload containing deeply nested arrays. The io.netty.handler.codec.redis.RedisArrayAggregator function aggregates RedisMessage parts into ArrayRedisMessage using a Deque<AggregateState> to track nested arrays. Because there is no limit on the maximum depth of these arrays, a continuous stream of nested array headers forces the server to allocate a massive number of AggregateState instances and ArrayList collections. This leads to heap memory exhaustion and an OutOfMemoryError.

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-44250

GHSA-3244-J874-RHC2

Affected Products

Netty-Codec-Redis

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-44250 · Security Note
• https://osv.dev/vulnerability/GHSA-3244-j874-rhc2 · Vendor Advisory
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2 · Note