CVE-2026-93572 PUBLISHED

Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits

Assigner: redhat
Reserved: 18.09.2026 Published: 18.09.2026 Updated: 18.09.2026

A flaw was found in Netty's RedisArrayAggregator component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the RedisArrayAggregator to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using RedisDecoder with RedisArrayAggregator on untrusted traffic.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor Red Hat
Product Red Hat build of Apache Camel for Spring Boot 4
Versions Default: affected
Vendor Red Hat
Product Red Hat Fuse 7
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Single Sign-On 7
Versions Default: affected

Workarounds

See https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg for fixed versions and remediation guidance.

References

Problem Types

  • Allocation of Resources Without Limits or Throttling CWE