CVE-2026-44250

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Summary

An attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError.

Details

io.netty.handler.codec.redis.RedisArrayAggregator aggregates RedisMessage parts into ArrayRedisMessage. It uses a Deque<AggregateState> to keep track of nested arrays. However, it does not limit the maximum depth of nested arrays. When an attacker sends a continuous stream of nested array headers (e.g., *1\r\n*1\r\n*1\r\n...), RedisArrayAggregator pushes a new AggregateState onto the stack and allocates a new ArrayList for each header. Because there is no depth limit, an attacker can send millions of such headers. This consumes a massive amount of heap memory for the AggregateState instances and their backing ArrayLists, eventually resulting in an OutOfMemoryError.

Impact

Denial of Service due to memory exhaustion. Any application using Netty's RedisArrayAggregator to handle untrusted Redis traffic is vulnerable.

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-redis 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-42586, CVE-2026-44250, CVE-2026-44890, CVE-2026-48006, CVE-2026-50011, and CVE-2026-56818.

CVE-2026-42586: Netty: CRLF Injection in Netty Redis Codec Encoder

CVE-2026-44250: Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

CVE-2026-44890: Netty has Unbounded Direct Memory Consumption in its RedisDecoder

CVE-2026-48006: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

CVE-2026-50011: Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

CVE-2026-56818: Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

This patched artifact is a drop-in replacement for io.netty:netty-codec-redis 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 12 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2.

TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.115.Final-tuxcare.9.

TuxCare rebuilt 14 io.netty packages to address 26 CVEs. Fixed in 4.1.118.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 17 CVEs. Fixed in 4.2.12.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 16 CVEs. Fixed in 4.2.2.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.74.Final-tuxcare.1.

TuxCare rebuilt 2 io.netty packages to address 4 CVEs. Fixed in 4.1.80.Final-tuxcare.5.

TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.87.Final-tuxcare.4.

TuxCare rebuilt 2 io.netty packages to address 5 CVEs. Fixed in 4.1.81.Final-tuxcare.2.

These are all security issues fixed in the netty-4.1.135-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issue

This update for netty, netty-tcnative fixes the following issues

Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:

• CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).
• CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).
• CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).
• CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).
• CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).
• CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).
• CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).
• CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).
• CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (bsc#1268250).
• CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).
• CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).
• CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (bsc#1268255).
• CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).
• CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers (bsc#1268258).
• CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).
• CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).
• CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (bsc#1268261).
• CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (bsc#1268262).

Changes:

• MQTT: Allow MQTT 5 CONNECT with password only
• ChannelInitializer: correct misleading comment on exceptionCaught route
• HTTP/2: Parse request-target path like Vert.x (4.1 backport)
• HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
• IpSubnetFilter: Correctly handle ipv6
• Configurable bound on RedisArrayAggregator
• Redis: Limit decoded length
• DNS: Ensure query id is not predictible
• Wrapping plain trust manager silently disables hostname verification
• MQTT: Reject malformed no-payload packets with non-zero Remaining Length
• HAProxy: Reject HAProxyMessages with malformated TLV and not leak memory
• SSL: Use sane defaults as limits for the client hello length and timeout
• DNS: Only cache CNAME if part of the queried domain
• HTTP/2: Enforce max concurrent streams for misbehaving clients
• Dns: Insufficient Bailiwick Validation for NS Records
• HTTP2: DelegatingDecompressorFrameListener must release memory in all cases
• Pass maxAllocation to Brotli and Zstd decoders
• HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory
• Add maxWindowLog parameter to ZstdDecoder to bound memory allocation
• HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs
• Epoll / Kqueue: Correctly handle receive of FD
• SCTP: Limit the number of inflight incomplete SCTP messages and the number of fragments
• Redis: Correctly release incomplete message on removal when using RedisArrayAggregator
• Redis: Limit the maximum number of nested arrays
• HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake
• Marshalling: Explicit document security requirements
• Pin HTTP/RTSP version + method normalization to Locale.US
• Adaptive: Fix concurrency issue in adaptive allocator
• Pin multipart Content-Type / Content-Transfer-Encoding case…