CVE-2026-44890: Netty has Unbounded Direct Memory Consumption in its RedisDecoder

Synopsis

An unbounded direct memory consumption vulnerability exists in Netty's RedisDecoder component (netty-codec-redis). A remote, unauthenticated attacker can exploit this by sending crafted Redis protocol payloads across multiple connections that lack the expected carriage-return/newline terminator, exhausting the server's off-heap direct memory pool and triggering an OutOfDirectMemoryError that prevents legitimate connections from being processed. Successful exploitation results in a full denial of service for the affected Netty instance. Fix versions 4.1.135.Final and 4.2.15.Final address the issue; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream packages are published to standard repositories.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Netty Redis service over the network; the vulnerable component is exposed via a standard network socket.

• AuthenticationNot required

  No credentials or account are needed; the attack works against any unauthenticated Redis endpoint handled by Netty.

• Victim interactionNot required

  No user or operator action is required; the attacker sends crafted payloads directly to the service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• Crashes the Netty process or exhausts its direct memory pool, making the service unable to accept or process any new connections.
• All in-flight Redis operations handled by the affected Netty instance are dropped, causing request failures for any downstream application relying on that connection pool.
• Recovery requires a process restart or memory reclamation, creating a sustained outage window proportional to how quickly operations teams detect and respond to the OutOfDirectMemoryError.