CVE-2026-50011

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final

Description Netty is a network application framework for developing protocol servers and clients. The RedisArrayAggregator pre-allocates an ArrayList with an initial capacity based on the RESP array element count declared in an array header. This count is retrieved from the wire before the child messages exist, allowing a small malicious header to claim a huge initial capacity. The aggregator initiates a new aggregation level upon receiving an ArrayHeaderRedisMessage and executes new ArrayList<>(length) for positive lengths without a configurable maximum. While the RedisDecoder enforces RedisConstants.REDIS MESSAGE MAX LENGTH for bulk string lengths, it does not apply this cap to array header lengths. This allows extremely large declared array sizes to pass decoding, leading to immediate Object[] reservation and potential resource exhaustion. The issue involves the decodeLength() function in io.netty.handler.codec.redis.RedisDecoder and the decodeRedisArrayHeader() function in io.netty.handler.codec.redis.RedisArrayAggregator.

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final.