CVE-2026-56818

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description The RedisArrayAggregator Redis codec fails to clear retained partial aggregate state when the maxElements limit is exceeded, although it correctly does so when the maxNestedArrayDepth limit is reached. An unauthenticated peer can exploit this by initiating a valid RESP array, sending a bulk string child, and then sending a nested array header that exceeds the configured maxElements. While the decodeRedisArrayHeader() function throws a decoder exception, the partial aggregate remains retained in the handler. If the channel remains open after the exception, subsequent messages are consumed into the pre-error aggregate, allowing the peer to maintain attacker-controlled state and pin retained pooled buffers.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later.