CVE-2026-50011: Netty Redis Memory Exhaustion Denial of Service

Technical summary

CVE-2026-50011 affects Netty's RedisArrayAggregator component, which handles RESP (Redis Serialization Protocol) array deserialization. The vulnerability stems from a resource allocation flaw: the aggregator reads the array element count from the wire protocol header and immediately pre-allocates an ArrayList with that capacity before child messages are received or validated. A crafted RESP array header declaring a count in the billions will cause ArrayList instantiation to reserve proportional heap memory, enabling a denial-of-service attack. The issue is rooted in CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Patched versions 4.1.135.Final and 4.2.15.Final implement proper bounds checking or defer allocation until content validation.

Business impact

Availability is the primary business concern. Services relying on Netty for Redis connectivity or general network I/O face denial-of-service risk: a single attacker connection can exhaust heap memory and trigger JVM out-of-memory errors, crashing the process and interrupting business operations. In multi-tenant or shared infrastructure scenarios, an attacker targeting one application can degrade or crash adjacent services. Organizations running unpatched versions should expect potential service outages if exposed to untrusted network input.

Affected systems

Netty versions prior to 4.1.135.Final (4.1.x branch) and 4.2.15.Final (4.2.x branch) are affected. Any application embedding Netty and processing RESP protocol messages—including Redis clients, caches, and message brokers built on Netty—inherits this risk. The vulnerability applies regardless of deployment model (on-premises, cloud, containerized) because it is triggered by network input, not platform-specific factors.

Exploitability

Exploitation requires network access to an affected Netty service and the ability to send RESP protocol traffic. No authentication, user interaction, or special privilege is needed. An attacker needs only to craft a RESP array header with a large element count and send it over the wire. Exploitation is straightforward; no complex gadget chains or race conditions are required. The vulnerability is remotely exploitable with minimal barriers to entry, making it a practical target for automated scanning and attack campaigns.

Remediation

Upgrade Netty to version 4.1.135.Final or later for the 4.1.x line, or 4.2.15.Final or later for the 4.2.x line. If using other major versions, verify against the vendor security advisory for the appropriate patch version. Upgrading is the definitive fix. As a temporary mitigation for environments unable to patch immediately, restrict network access to trusted sources only and implement rate limiting on inbound RESP connections to slow attack attempts, though these do not eliminate the underlying vulnerability.

Patch guidance

Apply the official Netty release from the Netty project repository. For Maven-based projects, update the dependency version in pom.xml to 4.1.135.Final or 4.2.15.Final (or later) and rebuild. For Gradle, update the version constraint in build.gradle. Verify the patch by checking the Netty CHANGELOG and confirming the RedisArrayAggregator fix is included. Test thoroughly in a staging environment before production rollout, especially if Netty is used in load-critical paths; while the patch itself should be safe, integration testing mitigates any unforeseen interactions.

Detection guidance

Monitor heap memory usage patterns for sudden spikes correlated with inbound network traffic. Look for JVM out-of-memory errors in application logs, particularly those mentioning 'ArrayList' or 'RESP'. Network-based detection is difficult without protocol inspection, but IDS/IPS rules can be developed to flag RESP array headers with suspiciously large element counts (e.g., claims of millions of elements in a single message). Endpoint Detection and Response (EDR) solutions can track process memory growth and termination related to heap exhaustion. Correlate application crashes with unusual network connections.

Why prioritize this

This vulnerability merits high priority for any organization running affected Netty versions. The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of network accessibility, lack of authentication, and guaranteed denial-of-service impact. Unlike many high-severity vulnerabilities requiring specific configurations or user interaction, this one is triggered by any RESP message processing and affects availability directly. Organizations should patch or isolate affected systems within days, not weeks.

Risk score, explained

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields 7.5 due to: Attack Vector Network (AV:N)—exploitable remotely with no special network setup; Attack Complexity Low (AC:L)—no race conditions or exotic conditions needed; Privileges Required None (PR:N)—no authentication or authorization bypass required; User Interaction None (UI:N)—attack succeeds without user action; Scope Unchanged (S:U)—impact is limited to the vulnerable component; Confidentiality None (C:N)—no data exposure; Integrity None (I:N)—no data modification; Availability High (A:H)—guaranteed denial of service. The lack of confidentiality or integrity impact prevents a critical rating, but the guaranteed availability impact and trivial exploitability justify the HIGH severity.

Frequently asked questions