CVE-2026-44250: Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Synopsis

Memory exhaustion vulnerability in the netty-codec-redis component of the Netty network application framework. An unauthenticated remote attacker can send a crafted Redis protocol payload containing deeply nested arrays, forcing the server to allocate a massive number of state objects until the JVM throws an OutOfMemoryError. Successful exploitation causes a full denial of service of the affected application. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream publishes a fixed release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the service over the network to deliver a crafted Redis protocol payload.

• AuthenticationNot required

  No credentials or account of any kind are needed to send the malicious payload.

• Victim interactionNot required

  The vulnerability triggers purely through the inbound network payload; no user action is required.

• Attack complexityDetail

  The exploit is reliable and condition-free: sending a specifically crafted deeply nested array payload is sufficient to trigger memory exhaustion without needing to satisfy any race condition or environmental prerequisite.

Blast Radius

• The affected JVM process exhausts available heap memory, resulting in an OutOfMemoryError that crashes or permanently hangs the application.
• All in-flight requests and active connections served by the Netty application are dropped at the moment of memory exhaustion.
• Dependent services that rely on the Netty-based endpoint lose connectivity, potentially cascading disruption to downstream consumers.