Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

published 2026-06-08 5 mo ago modified 2026-09-18 52 d ago also EUVD-2026-36356 , GHSA-3244-j874-rhc2

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits: 0; none known

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Patch / fix

fixed in 4 distros 3 links 2

maven io.netty:netty-codec-redis 4.1.135.Final, 4.2.15.Final
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.5.26-2.Final_redhat_00001.1.el7eap, 0:1.10.0-46.Final_redhat_00044.1.el7eap, 0:2.2.40-2.SP3_redhat_00001.1.el7eap, 0:2.3.14-11.SP11_redhat_00001.1.el7eap, 0:2.5.5-24.SP12_redhat_00016.1.el7eap, 0:2.5.5-30.SP12_redhat_00020.1.el7eap, 0:2.16.0-22.redhat_00057.1.el7eap, 0:2.18.8-1.redhat_00003.1.el7eap, 0:4.1.135-1.Final_redhat_00001.1.el7eap, 0:5.0.31-3.SP2_redhat_00001.1.el7eap, 0:7.4.25-2.GA_redhat_00001.1.el7eap
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:1.5.26-2.Final_redhat_00001.1.el8eap, 0:1.10.0-46.Final_redhat_00044.1.el8eap, 0:2.2.40-1.SP3_redhat_00001.1.el8eap, 0:2.3.14-11.SP11_redhat_00001.1.el8eap, 0:2.5.5-24.SP12_redhat_00016.1.el8eap, 0:2.5.5-30.SP12_redhat_00020.1.el8eap, 0:2.16.0-22.redhat_00057.1.el8eap, 0:2.18.8-1.redhat_00003.1.el8eap, 0:4.1.135-1.Final_redhat_00001.1.el8eap, 0:5.0.31-3.SP2_redhat_00001.1.el8eap, 0:7.4.25-2.GA_redhat_00001.1.el8eap
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:1.5.26-2.Final_redhat_00001.1.el9eap, 0:1.10.0-46.Final_redhat_00044.1.el9eap, 0:2.2.40-1.SP3_redhat_00001.1.el9eap, 0:2.3.14-11.SP11_redhat_00001.1.el9eap, 0:2.5.5-24.SP12_redhat_00016.1.el9eap, 0:2.5.5-30.SP12_redhat_00020.1.el9eap, 0:2.16.0-22.redhat_00057.1.el9eap, 0:2.18.8-1.redhat_00003.1.el9eap, 0:4.1.135-1.Final_redhat_00001.1.el9eap, 0:5.0.31-3.SP2_redhat_00001.1.el9eap, 0:7.4.25-2.GA_redhat_00001.1.el9eap

red hat suse opensuse

eap7-netty jboss enterprise application platform els 7.4 4.1.135-1.Final_redhat_00001.1.el8eap
eap7-wildfly jboss enterprise application platform els 7.4 7.4.25-2.GA_redhat_00001.1.el8eap
eap7-undertow jboss enterprise application platform els 7.4 2.2.40-1.SP3_redhat_00001.1.el8eap
eap7-netty-all jboss enterprise application platform els 7.4 4.1.135-1.Final_redhat_00001.1.el8eap
eap7-ironjacamar jboss enterprise application platform els 7.4 1.5.26-2.Final_redhat_00001.1.el8eap
eap7-netty-codec jboss enterprise application platform els 7.4 4.1.135-1.Final_redhat_00001.1.el8eap
eap7-jackson-core jboss enterprise application platform els 7.4 2.18.8-1.redhat_00003.1.el8eap
eap7-netty-buffer jboss enterprise application platform els 7.4 4.1.135-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2026:53645 RHSA-2026:53646 RHSA-2026:53644

netty-tcnative SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.0.79-150200.3.45.1
netty SLE Module for Package Hub 15 SP7 4.1.135-150200.4.50.1

suse advisories SUSE-SU-2026:2802-1

netty openSUSE Tumbleweed 4.1.135-1.1

opensuse advisories openSUSE-SU-2026:11033-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-44250 updated 2026-11-04 cvss 7.5

netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays

Red Hat Fuse 7 netty-codec-redis
affected: workaround, no fix planned “Will not fix”
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
fixed: vendor fix RHSA-2026:37390
Red Hat Data Grid 8.6.2
fixed: vendor fix RHSA-2026:41951
Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.25-2.GA_redhat_00001.1.el7eap, eap7-jackson-core 2.18.8-1.redhat_00003.1.el7eap, eap7-netty 4.1.135-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-jackson-databind 2.18.8-1.redhat_00003.1.el7eap, eap7-netty-all 4.1.135-1.Final_redhat_00001.1.el7eap, +78 more
fixed: vendor fix RHSA-2026:53644
Red Hat JBoss Enterprise Application Platform 7.4.25
fixed: vendor fix RHSA-2026:53806
Red Hat JBoss Enterprise Application Platform 8 netty-codec Red Hat JBoss Enterprise Application Platform Expansion Pack netty-codec-redis
not affected: component not present
Red Hat Single Sign-On 7 netty-codec-redis
not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 4 mo ago (2026-06-12)

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	io.netty:netty-codec-redis	>=4.2.0.Final, <4.2.15.Final <4.1.135.Final	4.2.15.Final 4.1.135.Final

Affected products

netty netty
Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
Red Hat Red Hat Data Grid 8.6.2
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
Red Hat Red Hat JBoss Enterprise Application Platform 8.1
Red Hat Red Hat Fuse 7
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat Red Hat Single Sign-On 7

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling

Technology feeds

Spring rss critical rss

References

access.redhat.com /errata/RHSA-2026:53644
vendor-advisory
access.redhat.com /errata/RHSA-2026:53645
vendor-advisory
access.redhat.com /errata/RHSA-2026:53646
vendor-advisory
access.redhat.com /errata/RHSA-2026:41951
vendor-advisory
access.redhat.com /errata/RHSA-2026:50085
vendor-advisory
access.redhat.com /errata/RHSA-2026:37390
vendor-advisory
github.com /netty/netty/security/advisories/GHSA-3244-j874-rhc2
web, vendor-advisory
github.com /netty/netty/releases/tag/netty-4.1.135.Final
web, release-notes
github.com /netty/netty/releases/tag/netty-4.2.15.Final
web, release-notes
access.redhat.com /security/cve/CVE-2026-44250
vdb-entry
bugzilla.redhat.com /show_bug.cgi?id=2488062
issue-tracking
security.access.redhat.com /data/csaf/v2/vex/2026/cve-2026-44250.json
nvd.nist.gov /vuln/detail/CVE-2026-44250
advisory
github.com /netty/netty
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary