CVE-2026-44890

Name of the Vulnerable Software and Affected Versions netty-codec-redis versions prior to 4.1.135.Final netty-codec-redis versions prior to 4.2.15.Final

Description A remote attacker can cause a Denial of Service (DoS) by sending specially crafted Redis payloads across multiple connections without proper termination using r . The decodeLength() function in io.netty.handler.codec.redis.RedisDecoder reads bytes from the network until it encounters a character but fails to enforce a maximum length check while buffering. By sending a continuous stream of digits without a character, an attacker can exhaust the server's direct memory pool, resulting in an OutOfDirectMemoryError and preventing legitimate connections from being processed.

Recommendations Update netty-codec-redis to version 4.1.135.Final or later. Update netty-codec-redis to version 4.2.15.Final or later.