CVE-2026-48006

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final

Description The RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in the depths field but lacks channelInactive, handlerRemoved, or exceptionCaught methods to release them during pipeline teardown. Since the leaked buffers are slices of PooledByteBufAllocator chunks, they prevent these chunks from returning to the JVM-wide direct-memory pool. Continuous connection churn by a network peer drains this shared pool, leading to allocation failures across all Netty channels in the process.

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final.