CVE-2026-48006: Netty Redis Memory Leak – Direct Memory Exhaustion DoS

Technical summary

CVE-2026-48006 affects Netty's RedisArrayAggregator handler in versions prior to 4.1.135.Final and 4.2.15.Final. The handler accumulates child message references in a `depths` field to reconstruct RESP array responses, but lacks lifecycle callbacks (channelInactive, handlerRemoved, exceptionCaught) to release these retained buffers when channels disconnect abruptly. Because Netty uses PooledByteBufAllocator with chunked direct memory, leaked buffer slices prevent their parent chunks from returning to the JVM-wide direct-memory pool. Attacker-controlled connection churn monotonically drains this global resource, eventually exhausting direct memory and causing allocation failures across all channels in the process.

Business impact

Applications using Netty for Redis protocol handling face availability risk. An attacker with network access can trigger repeated connection cycles, gradually depleting direct memory until the application becomes unable to accept or process new connections. This manifests as denial of service—not an immediate crash, but progressive degradation and eventual unresponsiveness. Services handling high volumes of transient Redis connections are most exposed.

Affected systems

Netty versions prior to 4.1.135.Final (4.1.x branch) and 4.2.15.Final (4.2.x branch) are affected. Any application embedding Netty and using the RedisArrayAggregator handler is vulnerable. This includes Java applications that bridge Redis client libraries or directly implement Redis protocol handling atop Netty.

Exploitability

Exploitation requires only network access; no credentials, user interaction, or special environment configuration is needed. An attacker can open and close TCP connections to a Netty-based Redis service repeatedly, each incomplete request leaking pooled memory. The attack is trivial to script and does not require deep protocol knowledge—simple connection thrashing suffices. However, the leak is incremental; sustained or high-rate connection churn is needed to cause measurable impact on typical deployments.

Remediation

Upgrade to Netty 4.1.135.Final or later (for the 4.1.x branch) or 4.2.15.Final or later (for the 4.2.x branch). These versions include the missing lifecycle event handlers in RedisArrayAggregator, ensuring retained buffers are released when connections drop or handlers are removed. Verify the patch version in your dependency management tool before and after upgrade.

Patch guidance

1. Identify all instances of Netty in your build dependencies (Maven pom.xml, Gradle build.gradle, or equivalent). 2. Check which version branch you are using (4.1.x or 4.2.x). 3. Update Netty to 4.1.135.Final or newer if on 4.1, or to 4.2.15.Final or newer if on 4.2. 4. Run your unit and integration tests, particularly those exercising Redis protocol handling or connection lifecycle events. 5. Monitor direct-memory usage after deployment; verify that connection churn no longer causes memory to remain pinned. 6. For critical deployments, test the patch in a staging environment with sustained connection churn to confirm the leak is resolved.

Detection guidance

Monitor direct-memory pressure in your JVM using tools like `jcmd <pid> VM.native_memory summary` or APM platforms that track GC and off-heap memory. Look for monotonically increasing direct-memory usage that does not recover after garbage collection, especially following periods of connection churn. Application logs or metrics showing allocation failures (`OutOfDirectMemoryException` or similar) after sustained traffic spikes are a strong signal. Intrusion detection rules can flag repeated short-lived connections to Redis ports, though this may generate false positives in high-churn environments.

Why prioritize this

This vulnerability merits prompt patching despite a moderate CVSS score (7.5). The attack surface is broad—any network-connected Netty application using RedisArrayAggregator can be targeted—and exploitation is trivial. The impact is availability degradation rather than data compromise, but the gradual nature of the leak means detection may be delayed, allowing attackers to cause sustained outages. Organizations running Redis-backed services should prioritize this update in their patch cycles.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects the attack vector (network-accessible, no privileges or user interaction required), low complexity, and high impact to availability. The absence of confidentiality or integrity impact keeps the score moderate rather than critical. However, the practical exploitability and ease of triggering sustained DoS against production systems justify rapid remediation.

Frequently asked questions