CVE-2026-44250 — Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Affected: netty, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat Data Grid 8.6.2, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9, Red Hat JBoss Enterprise Application Platform 8.1, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

GHSA-3244-j874-rhc2 — Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Affected: Maven: io.netty:netty-codec-redis

### Summary An attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError.

### Details io.netty.handler.codec.redis.RedisArrayAggregator aggregates RedisMessage parts into ArrayRedisMessage. It uses a `Deque<AggregateState>` to keep track of nested arrays. However, it does not limit the maximum depth of nested arrays. When an attacker sends a continuous stream of nested array headers (e.g., `*1\r\n*1\r\n*1\r\n...`), RedisArrayAggregator pushes a `new AggregateState` onto the stack and allocates a `new ArrayList` for each header. Because there is no depth limit, an attacker can send millions of such headers. This consumes a massive amount of heap memory for the AggregateState instances and their backing ArrayLists, eventually resulting in an OutOfMemoryError.

### Impact Denial of Service due to memory exhaustion. Any application using Netty's RedisArrayAggregator to handle untrusted Redis traffic is vulnerable.

Most recent entries from all

CVE-2026-44250 — Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

GHSA-3244-j874-rhc2 — Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays