CVE-2026-44250: Netty Redis Codec Denial-of-Service via Nested Array Memory Exhaustion

Technical summary

CVE-2026-44250 is a resource exhaustion vulnerability in netty-codec-redis caused by improper handling of deeply nested array structures in Redis protocol payloads. The vulnerability exists in the codec's state management during parsing—each nesting level triggers allocation of additional collections and objects without adequate bounds checking or depth limits. When an attacker sends a maliciously crafted Redis array with excessive nesting, the cumulative memory allocations exceed heap limits, triggering an OutOfMemoryError and causing service unavailability. The root causes map to CWE-400 (uncontrolled resource consumption) and CWE-770 (allocation of resources without limits or throttling).

Business impact

Organizations relying on Netty-based Redis clients or servers face potential service disruption. A remote attacker requires only network access to send the malicious payload—no authentication or user interaction needed. The attack targets application availability directly: affected services will crash and require manual restart. For systems dependent on Redis for caching, session management, or real-time data operations, this could cascade into broader application failures. Customers or users may experience extended outages. There is no confidentiality or integrity risk; the attack surface is pure denial-of-service.

Affected systems

The vulnerability affects netty-codec-redis versions prior to 4.1.135.Final and prior to 4.2.15.Final. Any application embedding Netty and using the Redis codec for protocol handling is in scope—this includes custom Redis clients, embedded Redis protocol servers, and integration layers that use Netty for network I/O with Redis protocol parsing. Both the 4.1.x and 4.2.x release lines require patching. Applications on older Netty versions without Redis codec usage are not affected.

Exploitability

Exploitation is straightforward and requires no special privileges or user interaction. The attack vector is network-based (AV:N), the attack complexity is low (AC:L), and no authentication is required (PR:N). An attacker needs only to send a single crafted Redis command over the network. The barrier to weaponization is low—attackers need to understand basic Redis protocol structure and nesting syntax, both well-documented. However, exploit code is not widely public yet, and discovery likely depends on active scanning or reconnaissance of exposed Redis/Netty services. The CVSS score of 7.5 (HIGH) reflects the ease of exploitation and severe impact on availability.

Remediation

Upgrade netty-codec-redis to version 4.1.135.Final or later for the 4.1.x line, or to version 4.2.15.Final or later for the 4.2.x line. The patch introduces proper bounds checking and nesting depth limits during Redis array parsing, preventing unbounded resource allocation. Organizations should verify they are using one of these patched versions in all dependencies—transitive dependencies through other libraries should be explicitly confirmed. If you cannot immediately patch, consider network-level controls: restrict Redis protocol traffic to trusted sources or implement rate limiting on incoming Redis commands. However, these are temporary mitigations and not substitutes for patching.

Patch guidance

Apply patches immediately to production systems. For 4.1.x deployments, upgrade to 4.1.135.Final or any subsequent 4.1.x release. For 4.2.x deployments, upgrade to 4.2.15.Final or any subsequent 4.2.x release. Before deploying, verify patch compatibility with your application's Netty configuration and any custom codec extensions. Test in a staging environment to confirm no regressions. Dependency management tools (Maven, Gradle) should be configured to pull the patched versions. For organizations on older 4.0.x or earlier lines: these versions are out of support; plan migration to a supported release line. Coordinate patching with your change management process, as application restarts will be required.

Detection guidance

Monitor for OutOfMemoryError exceptions and process crashes correlated with Redis codec operations. Enable detailed logging in Netty's codec pipeline to observe array parsing behavior, particularly focusing on nested structure depth. Network-level detection is possible: inspect Redis protocol traffic for commands with abnormally high nesting levels (e.g., RESP array packets containing dozens of nested arrays). Baseline normal nesting depth in your environment and alert on anomalies. Intrusion detection/prevention systems can be tuned to flag malformed Redis arrays with suspicious nesting. Host-based memory usage spikes coupled with Netty process activity warrant investigation. These detections are most effective as indicators of attempted exploitation—they should trigger immediate patch verification and potential containment.

Why prioritize this

This vulnerability merits immediate remediation. The HIGH CVSS score (7.5) combines trivial exploitability with guaranteed availability impact. No authentication is required, and an attacker needs only network reachability to the vulnerable service. The attack is deterministic—sending the payload will crash the application. Any organization using Netty's Redis codec in production should consider this critical for their environment. While broader internet exposure varies (many Redis instances are internal), the total ease of exploitation combined with service disruption justifies treating this as a priority patch.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects: Attack Vector Network (low barrier), Attack Complexity Low (no special conditions required), Privileges Required None (unauthenticated attacker can exploit), User Interaction None (no human action required), and Availability Impact High (service becomes unavailable). Confidentiality and Integrity are not impacted. The score appropriately captures the severity of denial-of-service via resource exhaustion. Organizations with critical Redis dependencies or high availability requirements should treat this as more urgent than the score alone suggests.

Frequently asked questions