GitHub Advisoryadvisory · Maven

GHSA-6jv9-x5w9-2ccm Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

HIGH Published 2026-06-11 Modified 2026-09-18 Official page ↗
Aliases
CVE-2026-48006
Ecosystem
Maven
Packages
io.netty:netty-codec-redis
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-401, CWE-772
Reviewed
2026-06-11

Affected packages

• Maven io.netty:netty-codec-redis: >= 4.2.0.Final, < 4.2.15.Final → fixed in 4.2.15.Final • Maven io.netty:netty-codec-redis: < 4.1.135.Final → fixed in 4.1.135.Final

Description

Impact The RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process.

Related

Alias · CVE (1)

  • CVE-2026-48006 Netty is a network application framework for development of protocol servers and clients. vulnerability

Weakness · CWE (2)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness
  • CWE-772 Missing Release of Resource after Effective Lifetime weakness

References