CVE-2026-44250
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In the Netty library (netty-codec-redis) before versions 4.1.135.Final and 4.2.15.Final, a DoS vulnerability was found. An attacker can cause memory exhaustion and an OutOfMemoryError by sending a crafted Redis payload with deeply nested arrays, forcing the server to allocate a massive number of state objects and collections.
Risk Assessment
The risk is a remote denial of service (DoS) via a specially crafted Redis query, potentially exhausting server memory and crashing applications using the vulnerable Netty version.
Recommendation
Immediately update Netty to version 4.1.135.Final or 4.2.15.Final (or later). If an update is not possible, consider restricting access to the Redis service to trusted sources only.
Original NVD description (English source)
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.