8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48006

CVE-2026-48006: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

Impact

The RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (depths field) but defines no channelInactive, handlerRemoved, or exceptionCaught method to release them when the pipeline tears down. Because the leaked buffers are slices of PooledByteBufAllocator chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48006

CVE-2026-48006:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-redis	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-codec-redis	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a memory leak in io.netty.handler.codec.redis.RedisArrayAggregator due to missing resource cleanup logic. The handler's decode method buffers incoming parts of a Redis array message. The vulnerability was caused by the absence of the handlerRemoved and channelInactive lifecycle methods in the class. When a client connection is terminated prematurely before a complete array is sent, the buffered ByteBuf messages were not released, as there was no code to handle this event. This leads to a gradual leak of pooled direct memory. An attacker can exploit this by repeatedly opening connections, sending partial messages, and disconnecting, eventually exhausting the server's memory and causing a denial of service. The fix involves adding the handlerRemoved and channelInactive methods to ensure that any buffered messages are released when the channel is closed or the handler is removed from the pipeline. The decode function is identified as the vulnerable function because it is responsible for creating and managing the state (the buffered messages) that is leaked.

Vulnerable functions

io.netty.handler.codec.redis.RedisArrayAggregator.decode

codec-redis/src/main/java/io/netty/handler/codec/redis/RedisArrayAggregator.java

This method processes incoming Redis messages and buffers parts of a Redis array in an internal list (`depths`). The vulnerability lies in the fact that if the connection was terminated before a full array was received, there were no corresponding cleanup methods (`handlerRemoved`, `channelInactive`) to release these buffered messages. This caused the `ByteBuf` objects to be leaked, as they were never released back to the memory pool. Therefore, the `decode` method is the function that creates the state that is leaked.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.