AIKIDO-2026-198062
netty-codec-redis is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
netty-codec-redisTL;DR
RedisArrayAggregator enforces maxElements and maxNestedArrayDepth independently, but each nested RESP array header eagerly allocates a list sized to the declared length before any child elements arrive. Because these limits are not combined into a shared budget, a message with many nested array headers each declaring a huge length can reserve on the order of a billion slots from a few kilobytes of input. This exhausts heap memory and causes a denial of service. The fix enforces a combined allocation budget across all active nested aggregation states.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decodes RESP replies from an untrusted or MITM-capable Redis endpoint.
Background info
netty-codec-redis is vulnerable to Denial of Service (DoS) in versions 4.1.135.Final - 4.1.137.Final and 4.2.15.Final - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-codec-redis library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.