7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44250

CVE-2026-44250: Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Summary

An attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError.

Details

io.netty.handler.codec.redis.RedisArrayAggregator aggregates RedisMessage parts into ArrayRedisMessage. It uses a Deque<AggregateState> to keep track of nested arrays. However, it does not limit the maximum depth of nested arrays. When an attacker sends a continuous stream of nested array headers (e.g., *1\r\n*1\r\n*1\r\n...), RedisArrayAggregator pushes a new AggregateState onto the stack and allocates a new ArrayList for each header. Because there is no depth limit, an attacker can send millions of such headers. This consumes a massive amount of heap memory for the AggregateState instances and their backing ArrayLists, eventually resulting in an OutOfMemoryError.

Impact

Denial of Service due to memory exhaustion. Any application using Netty's RedisArrayAggregator to handle untrusted Redis traffic is vulnerable.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44250

CVE-2026-44250:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-redis	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-codec-redis	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in io.netty.handler.codec.redis.RedisArrayAggregator, which is susceptible to a Denial of Service attack due to memory exhaustion. An attacker can achieve this by sending a crafted Redis payload containing deeply nested arrays. The root cause is the absence of a depth limit for these nested arrays.

Analysis of the provided patch commits confirms this. Specifically, commit 728c98b8ec6597faaccebdc20bf757d6f4b6310b introduces a configurable limit, maxNestedArrayDepth, to control how many nested arrays can be processed. The core of the fix is in the decodeRedisArrayHeader method (which is called by the main decode method), where a check is added to ensure the current nesting depth does not exceed this new limit. If the limit is exceeded, a CodecException is thrown, preventing further processing and the associated memory allocation.

The primary vulnerable function is io.netty.handler.codec.redis.RedisArrayAggregator.decode, as it is the entry point in the channel pipeline for processing the malicious Redis messages. During an exploit, this function would be on the call stack as it attempts to decode the unending stream of nested array headers, leading to the allocation of AggregateState objects until memory is exhausted. The constructors were also modified to support this new security feature.

Vulnerable functions

io.netty.handler.codec.redis.RedisArrayAggregator.decode

codec-redis/src/main/java/io/netty/handler/codec/redis/RedisArrayAggregator.java

The `decode` method, which is the entry point for the `MessageToMessageDecoder`, processes incoming `RedisMessage` objects. Prior to the patch, when handling an `ArrayHeaderRedisMessage`, the internal logic did not enforce a limit on the nesting depth of arrays. This allowed an attacker to send a stream of deeply nested array headers, causing the `depths` deque to grow without bounds. Each addition to the deque also involved allocating new objects (`AggregateState` and `ArrayList`), leading to excessive memory consumption and ultimately an OutOfMemoryError (Denial of Service). The patch introduces a check for `maxNestedArrayDepth` within the `decodeRedisArrayHeader` method (called by `decode`) to mitigate this.

io.netty.handler.codec.redis.RedisArrayAggregator.RedisArrayAggregator

codec-redis/src/main/java/io/netty/handler/codec/redis/RedisArrayAggregator.java

The constructor was modified to accept a `maxNestedArrayDepth` parameter, which is used to configure the new security limit. The default constructor was also updated to use a safe default limit. While not directly processing the malicious input, this function is part of the mitigation and its modification is direct evidence of the fix.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.