CVE-2026-56818
Received Received - Intake

Memory Corruption in Netty Redis Codec

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-56818
EUVD
EUVD-2026-54558

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
netty netty 4.1.136_final
netty netty 4.2.16_final
netty netty to 4.1.136.final (inc)
netty netty to 4.2.16.final (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-703 The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Netty's RedisArrayAggregator allows retained partial aggregate state to persist when the maxElements limit is exceeded. When a peer sends a nested array header exceeding maxElements, Netty throws a decoder exception but fails to release the existing partial aggregate, leaving it retained in the handler. Subsequent messages may then be consumed into this stale aggregate, potentially pinning large pooled buffers until channel closure or handler removal.

Detection Guidance

Detecting this vulnerability requires checking if your Netty version is below 4.1.136.Final or 4.2.16.Final. Use commands like 'netty --version' or inspect dependency files (e.g., pom.xml, build.gradle) for Netty versions. Monitor for decoder exceptions in RedisArrayAggregator logs when maxElements limits are exceeded.

Impact Analysis

This vulnerability could lead to memory exhaustion in deployments handling untrusted Redis streams. If the channel remains open after an exception, attacker-controlled aggregate state may persist, consuming pooled buffers and potentially causing denial-of-service conditions due to resource exhaustion.

Compliance Impact

This vulnerability primarily impacts availability and integrity due to potential memory exhaustion from retained pooled buffers. While not directly violating GDPR or HIPAA, it could lead to denial-of-service conditions or unauthorized data access if exploited, indirectly affecting compliance by disrupting systems handling sensitive data.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or 4.2.16.Final or later. If upgrading is not immediately possible, ensure channels are closed or handlers are removed upon decoder exceptions to prevent retained aggregate state. Review Redis stream configurations to limit bulk string sizes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56818. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart