Redis Codec Vulnerability in Netty Framework
CVE-2026-56818
6.5MEDIUM
What is CVE-2026-56818?
The Netty framework contains a vulnerability in its RedisArrayAggregator codec which fails to clear the retained partial aggregate state when the sibling maxElements limit is crossed. This allows an attacker to exploit the system by sending specially crafted requests that keep the attacker-controlled aggregate state alive. Even after a decoder exception is triggered, if the channel remains open, future messages can still be consumed into the pre-error aggregate. This issue has been addressed in Netty versions 4.1.136.Final and 4.2.16.Final, where the handling of the retained state has been improved to mitigate this risk.
Affected Version(s)
netty < 4.1.136.Final < 4.1.136.Final
netty >= 4.2.0-Final, < 4.2.16.Final < 4.2.0-Final, 4.2.16.Final