PT-2026-47602 · Netty · Netty

Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-44890

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A Denial of Service (DoS) issue exists where an attacker can exhaust the server's direct memory pool, leading to an OutOfDirectMemoryError and preventing legitimate connections. This occurs because the decodeLength function in io.netty.handler.codec.redis.RedisDecoder reads bytes from the network until a character is encountered but does not enforce a maximum length check while buffering. An attacker can exploit this by opening multiple concurrent connections and sending a continuous stream of digits without the required r termination specified in the RESP protocol, causing the system to buffer data indefinitely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-44890

GHSA-6GHJ-FRRJ-JJJ3

Affected Products

Netty

References · 6

• https://osv.dev/vulnerability/GHSA-6ghj-frrj-jjj3 · Vendor Advisory
• https://github.com/netty/netty · Note
• https://twitter.com/dailycve/status/2064106840783307244 · Twitter Post
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note
• https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3 · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note