CVE-2026-93572

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw exists in the RedisArrayAggregator component of Netty. A remote attacker can cause heap memory exhaustion and a Denial of Service (DoS) by sending specially crafted nested Redis (RESP) array headers. Although maxElements and maxNestedArrayDepth limits were implemented, they are checked independently, and the allocator remains eager. This allows an attacker to send nested array headers with a length of 1,000,000 until the default nesting limit of 1024 is reached, potentially reserving over 1 billion child slots from approximately 12 KB of input. This occurs because the decodeRedisArrayHeader(...) function creates a new ArrayList(length) for every positive nested RESP array header before any child elements exist.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.