Netty RedisCodec RedisArrayAggregator Incomplete Cleanup on maxElements Exceeded

Vulnerability Overview RedisArrayAggregator max-elements Failure Results in Retention of Partial Aggregation State Vulnerability Description: clears retained partial aggregation state when the limit is exceeded, but fails to do so when the limit is exceeded. When a sibling limit is exceeded, a peer can initiate a valid RESP array, send a bulk-string child, and then send a nested array header with a length exceeding the configured . Netty throws a decoder exception, but the existing partial aggregation state is retained within the processor. Technical Details: retains non-array messages before adding them to . In , if , a is thrown. The subsequent nested depth branch clears the retained aggregation state before throwing. The missing cleanup in the first branch results in retained children and aggregation state being accessible after the exception. Affected Versions Affected Versions: - - 4.1.135.Final - 4.2.15.Final Fixed Versions: - 4.1.136.Final - 4.2.16.Final Impact: For Redis codec pipelines that continue running after a decoder exception, an unauthenticated peer can maintain attacker-controlled aggregation state until the channel is closed/removed or until subsequent messages complete the aggregation of that state. This can lead to the reuse of retained buffers prior to channel closure/removal or until subsequent messages complete the aggregation of that state. allows bulk strings up to ; therefore, retained children can be large in deployments aggregating untrusted Redis streams. Remediation Recommended Fix: Call before entering the branch. Consider applying the same cleanup to all unrecoverable errors that may occur when is not empty. Verification: The minimal cleanup approach was verified in a temporary head copy. Using , the focused fix behavior tests passed (2 tests passed, 0 failed). POC Code Additional Information CVSS Score: 6.5 / 10 CVSS Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: Low CVE ID: CVE-2026-56818 Weaknesses: - CWE-401 - CWE-763 Credit: Repository Why This Is Not Expected Behavior Public API documentation describes as aggregating parts of into and throwing a when the array header exceeds . It does not document the retention of pre-exception partial aggregation state that persists after the limit is breached. The adjacent nested depth branch already calls before throwing. The branch is a sibling aggregation state branch but lacks this cleanup. Netty's recent Redis byte cleanup patches explicitly released retained buffers for nested failures and processor removal, leaving the failure branch as an overlooked cleanup path.

Goal Reached Thanks to every supporter — we hit 100%!

Netty RedisCodec RedisArrayAggregator Incomplete Cleanup on maxElements Exceeded

More from this source