7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44890

CVE-2026-44890: Netty has Unbounded Direct Memory Consumption in its RedisDecoder

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without \r\n. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44890

CVE-2026-44890:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-redis	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-codec-redis	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in Netty's RedisDecoder, which is responsible for parsing the Redis protocol. The core of the issue is in the decodeLength method. This method was designed to read the length of an upcoming data element from the input stream. According to the Redis protocol, this length is terminated by a carriage return and a newline (\r\n). However, the vulnerable version of the code did not enforce a maximum size for the data it would buffer while searching for the newline character. An attacker could exploit this by sending a long sequence of digits without the terminating \r\n. This would cause the RedisDecoder to keep buffering data, waiting for a newline that never arrives. When done over multiple connections, this leads to excessive memory consumption in the server's direct memory pool, eventually causing an OutOfDirectMemoryError and a Denial of Service. The fix, identified in commit bff98ee51b5d0b7ee25fd5005f2169f2a0467efa, introduces a size check within the decodeLength method. It now ensures that the number of buffered bytes does not exceed the maximum valid length for a 64-bit integer, thus preventing the unbounded memory growth.

Vulnerable functions

io.netty.handler.codec.redis.RedisDecoder.decodeLength

codec-redis/src/main/java/io/netty/handler/codec/redis/RedisDecoder.java

This function is responsible for decoding the length of a Redis message. The vulnerability lies in its original implementation, which would buffer an unlimited amount of data while waiting for a newline character. An attacker could send a stream of digits without a newline, causing the buffer to grow indefinitely and leading to memory exhaustion. The patch introduces a check to limit the number of bytes that can be buffered, throwing an exception if the limit is exceeded.

io.netty.handler.codec.redis.RedisDecoder.decode

codec-redis/src/main/java/io/netty/handler/codec/redis/RedisDecoder.java

This is the main entry point for the Redis decoding logic. It calls the vulnerable `decodeLength` method to process incoming data. During an exploit that triggers the unbounded buffering in `decodeLength`, this `decode` function would be present in the stack trace as it is the orchestrator of the decoding process. The patch also modified its exception handling to discard any buffered data to prevent further issues.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.