Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-12T14:36:44 netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-772

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process.

This is an Important denial of service vulnerability in Netty's RedisArrayAggregator. Repeated connection churn by a network peer can lead to a permanent leak of direct-memory buffers, eventually exhausting the JVM-wide direct-memory pool. This can cause allocation failures across all Netty channels, impacting the availability and stability of Red Hat products utilizing Netty for Redis communication. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 2026-07-09T00:00:00Z RHSA-2026:37390 netty-codec-redis Red Hat Data Grid 8.6.2 2026-07-20T00:00:00Z RHSA-2026:41951 netty-codec-redis Red Hat Fuse 7 Will not fix netty-codec-redis Red Hat JBoss Enterprise Application Platform 7 Affected netty-codec-redis Red Hat JBoss Enterprise Application Platform Expansion Pack Affected netty-codec-redis Red Hat Single Sign-On 7 Not affected netty-codec-redis https://www.cve.org/CVERecord?id=CVE-2026-48006 https://nvd.nist.gov/vuln/detail/CVE-2026-48006 https://github.com/netty/netty/releases/tag/netty-4.1.135.Final https://github.com/netty/netty/releases/tag/netty-4.2.15.Final https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm