DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-56818: CVE-2026-56818: Denial of Service via Memory Pinning in Netty Redis Array Aggregator

#security #cve #cybersecurity

CVE-2026-56818: Denial of Service via Memory Pinning in Netty Redis Array Aggregator

Vulnerability ID: CVE-2026-56818
CVSS Score: 6.5
Published: 2026-08-07

A vulnerability in Netty's Redis codec allows remote unauthenticated attackers to cause a memory-pinning Denial of Service (DoS) due to the failure to release partial aggregate state when specific error conditions occur in RedisArrayAggregator. When processing Redis Serialization Protocol (RESP) messages, the aggregator fails to clear internal queues and release retained direct byte buffers on exception paths triggered by exceeded maxElements or invalid length properties. If the pipeline does not explicitly tear down the connection upon detecting a decoder error, subsequent elements continue utilizing the stale context, allowing memory blocks to remain indefinitely pinned.

TL;DR

Netty's Redis array aggregator fails to release pooled direct buffers upon specific limit-validation errors, allowing remote attackers to pin system memory and induce a Denial of Service.

Technical Details

  • CWE ID: CWE-401, CWE-703
  • Attack Vector: Network (AV:N)
  • CVSS Base Score: 6.5
  • Impact Type: Denial of Service (Memory Exhaustion)
  • Exploit Status: No public PoC available
  • CISA KEV Status: Not Listed

Affected Systems

  • Servers running Netty with Redis Serialization Protocol aggregation enabled
  • Netty: < 4.1.136.Final (Fixed in: 4.1.136.Final)
  • Netty: >= 4.2.0-Final, < 4.2.16.Final (Fixed in: 4.2.16.Final)

Code Analysis

Commit: 5b68c61

RedisArrayAggregator max-elements failure leaves retained partial aggregate state fix in 4.1 branch

Commit: bb2ff68

Port RedisArrayAggregator fix to 4.2 branch

Mitigation Strategies

  • Upgrade Netty to safe version releases
  • Implement strict channel teardown upon detecting codec errors
  • Monitor direct buffer allocator telemetry

Remediation Steps:

  1. Identify and update all netty-codec-redis dependencies to 4.1.136.Final or 4.2.16.Final
  2. Configure exception caught handlers in the channel pipeline to force-close connections on decoderexceptions
  3. Audit application dependencies to ensure no legacy transitive Netty packages remain active

References

Read the full report for CVE-2026-56818 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)