CVE-2026-44890: Netty Redis Codec Memory Exhaustion Denial of Service

Technical summary

CVE-2026-44890 is a resource exhaustion vulnerability in netty-codec-redis. The codec fails to properly validate or limit memory consumption when processing Redis protocol payloads that lack proper line terminators (`\r\n`). Malicious payloads sent across multiple concurrent connections trigger unbounded allocation from the direct memory pool. When direct memory exhaustion occurs (OutOfDirectMemoryError), the server becomes unable to accept or process new connections. The vulnerability maps to CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling).

Business impact

Organizations deploying Netty-based Redis servers or Redis protocol handlers face availability risk. A remote attacker requires no authentication and can mount a denial-of-service attack that crashes or severely degrades service without needing to compromise credentials or application logic. Any externally facing Redis service built on affected Netty versions is at risk. Recovery typically requires server restart, creating operational disruption. Industries relying on Redis for caching, sessions, or real-time features (e-commerce, SaaS platforms, financial services) may experience user-visible outages.

Affected systems

Netty versions prior to 4.1.135.Final and 4.2.15.Final are affected, specifically in the netty-codec-redis module. Systems running Netty as a dependency in Redis protocol implementations, custom Redis servers, or Redis protocol proxies are in scope. Verify your Netty version and whether the Redis codec module is included in your dependency tree. The vulnerability requires network access to the affected service; internal-only deployments have reduced risk but are not immune if the service accepts untrusted input.

Exploitability

Exploitation is straightforward and requires no special privileges. An attacker simply sends crafted Redis payloads lacking proper `\r\n` terminators across multiple connections. No authentication is needed (CVSS vector shows PR:N). The attack is network-accessible (AV:N) and does not depend on user interaction or race conditions (AC:L, UI:N). Public tools and techniques for Redis protocol fuzzing could be adapted. The barrier to exploitation is low; any competent attacker with network access to a vulnerable Redis service can attempt this attack.

Remediation

Upgrade netty-codec-redis to version 4.1.135.Final or later (for the 4.1.x branch) or 4.2.15.Final or later (for the 4.2.x branch). Patch releases have been issued to resolve the memory exhaustion issue. For applications unable to upgrade immediately, consider network-level mitigation: restrict Redis service exposure to trusted networks, use a load balancer or reverse proxy to rate-limit or validate incoming connections, or implement connection-level quotas to prevent unbounded growth of concurrent sessions.

Patch guidance

1. Identify your current Netty version in your build configuration (Maven pom.xml, Gradle build.gradle, or equivalent). 2. If using 4.1.x branch: upgrade to 4.1.135.Final or later. 3. If using 4.2.x branch: upgrade to 4.2.15.Final or later. 4. Verify the netty-codec-redis module is included in the upgrade. 5. Test the patched version in a staging environment to confirm compatibility with your Redis protocol handling code. 6. Deploy to production and monitor for any regressions or connection handling changes. 7. Consider reviewing other Netty modules in use to ensure they are also current, as this may be an opportune time for general dependency hygiene.

Detection guidance

Monitor for the following indicators: (1) OutOfDirectMemoryError exceptions in application logs, especially if correlated with spikes in network connections; (2) unusual memory pressure in the direct memory pool (observable via JVM metrics); (3) connection accept failures or "too many open files" errors under attack; (4) malformed Redis protocol messages in network packet captures (missing `\r\n` terminators). Implement alerting on direct memory pool saturation. If you have Redis protocol logging or debugging enabled, watch for incomplete or malformed commands. A sudden increase in the rate of connection attempts combined with memory exhaustion is a strong signal of active exploitation.

Why prioritize this

This vulnerability merits prompt patching because: (1) CVSS 7.5 (HIGH) reflects the complete availability impact with no preconditions; (2) exploitability is trivial and requires only network access; (3) no authentication or user interaction is required; (4) the attack is not currently listed in the CISA KEV catalog, but that should not delay patching given the ease of exploitation; (5) any publicly exposed Redis service on affected Netty versions is immediately vulnerable. Organizations should patch within their standard update cycle, with external-facing services prioritized.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH severity) reflects: Network Attack Vector (AV:N) — the flaw is remotely exploitable over the network; Low Attack Complexity (AC:L) — no special conditions are needed; No Privileges Required (PR:N) — the attacker does not need to authenticate; No User Interaction (UI:N) — the attack is fully automated; Unchanged Scope (S:U) — the impact is confined to the vulnerable component; and High Availability impact (A:H) — the service is completely unavailable. There is no confidentiality or integrity impact (C:N, I:N), hence the score stops at 7.5 rather than a critical level. The severity appropriately reflects a serious but contained denial-of-service threat.

Frequently asked questions