CVE-2026-56818— Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

在移除最后引用时对内存的释放不恰当(内存泄露)

Netty 资源管理错误漏洞

Netty是Netty团队开源的一个异步事件驱动的网络应用程序框架。 Netty 4.1.136.Final之前版本和4.2.0-Final至4.2.16.Final之前版本存在安全漏洞，该漏洞源于RedisArrayAggregator Redis编解码器在超过maxElements限制时未清除保留的部分聚合状态，导致解码器异常后状态残留，可能使未经身份验证的对等方跨安全限制异常保留攻击者控制的聚合状态并固定保留的池化缓冲区。

N/A

N/A