Loading vulnerability…
Memory Exhaustion in Netty RedisArrayAggregator via Deeply Nested Arrays
CVE-2026-44250 is a resource-exhaustion vulnerability in Netty's netty-codec-redis module affecting the 4.1.x branch before 4.1.135.Final and the 4.2.x branch before 4.2.15.Final. RedisArrayAggregator permits unlimited nesting of Redis arrays. Crafted deeply nested array headers cause excessive allocation of AggregateState objects and ArrayList collections, potentially exhausting JVM heap memory and triggering an OutOfMemoryError that results in denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker able to supply Redis protocol input to an affected application can exhaust its JVM heap, causing an OutOfMemoryError and disrupting service availability. The impact can extend to other application functionality sharing the affected JVM. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
No vendor-specified workaround is available. Until patched, restrict or block untrusted Redis protocol traffic reaching applications that use RedisArrayAggregator. Limit network access to affected endpoints to trusted peers; this reduces exposure but does not correct the aggregation flaw.
Patch, then assume compromise.
Upgrade io.netty:netty-codec-redis to 4.1.135.Final or later on the 4.1.x branch, or 4.2.15.Final or later on the 4.2.x branch. For products bundling Netty, deploy the applicable vendor security update rather than independently replacing managed dependencies. Fixed downstream releases include Red Hat Data Grid 8.6.2, Red Hat JBoss EAP 7.4.25, VMware Tanzu GemFire 10.3.0, and VMware Tanzu Data Flow on Kubernetes 2.0.8.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.