CVE-2026-48006: Netty Memory Leak DOS Vulnerability

CVE-2026-48006 Overview

CVE-2026-48006 is a memory leak vulnerability [CWE-401] in Netty, a network application framework used to develop protocol servers and clients. The flaw affects the RedisArrayAggregator handler in versions prior to 4.1.135.Final and 4.2.15.Final. The handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. Repeated connection churn from any network peer monotonically drains the shared PooledByteBufAllocator pool. The leak eventually causes allocation failures on all Netty channels in the affected process, producing a denial-of-service condition.

Critical Impact
Remote unauthenticated peers can exhaust JVM-wide direct memory by repeatedly opening and closing Redis pipeline connections, causing Netty-wide allocation failures.

Affected Products

Netty versions prior to 4.1.135.Final
Netty versions prior to 4.2.15.Final
Applications using the RedisArrayAggregator handler in Netty's Redis codec

Discovery Timeline

2026-06-12 - CVE-2026-48006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48006

Vulnerability Analysis

The RedisArrayAggregator aggregates RESP (REdis Serialization Protocol) array elements as they arrive on a pipeline. The handler stores partial child messages in a per-handler state field called depths. These messages are slices of buffers allocated from PooledByteBufAllocator chunks.

The handler does not override channelInactive, handlerRemoved, or exceptionCaught. When a connection terminates before a RESP array aggregate finishes, the retained ByteBuf references are never released. Because pooled slices keep their parent chunk alive, those chunks cannot return to the JVM-wide direct-memory pool.

Any remote peer that opens a Redis pipeline connection, sends a partial RESP array, and then closes the connection triggers the leak. Repeated connection churn drains the shared allocator pool monotonically. Once exhausted, every channel in the JVM that allocates direct buffers fails, regardless of which subsystem owns it.

Root Cause

The root cause is missing lifecycle cleanup in RedisArrayAggregator. The handler accumulates reference-counted buffers in its depths state but lacks the lifecycle hooks required by Netty's reference-counting contract. Without channelInactive or handlerRemoved releasing the retained buffers, every aborted aggregation produces a permanent leak [CWE-401].

Attack Vector

An unauthenticated network attacker connects to a service that uses Netty's Redis codec. The attacker sends a partial RESP array (such as *3\r\n$3\r\nFOO\r\n) and abruptly closes the TCP connection before completing the array. Each iteration leaks a pooled slice. Scripted connection churn from a single peer can exhaust direct memory across the entire JVM, denying service to unrelated Netty channels in the process.

No verified public exploit code is available for this CVE. See the GitHub Security Advisory GHSA-6jv9-x5w9-2ccm for the official advisory.

Detection Methods for CVE-2026-48006

Indicators of Compromise

Steadily increasing JVM direct memory usage (sun.misc.VM.maxDirectMemory() counters) without corresponding workload growth.
io.netty.util.internal.OutOfDirectMemoryError exceptions in application logs.
Netty leak detector warnings referencing RedisArrayAggregator or PooledByteBufAllocator chunks.
High volumes of short-lived Redis pipeline connections that close mid-RESP-array from untrusted peers.

Detection Strategies

Enable Netty's resource leak detector at PARANOID level (-Dio.netty.leakDetection.level=paranoid) in staging to surface retained ByteBuf instances.
Inventory dependencies with mvn dependency:tree or gradle dependencies to flag io.netty:netty-codec-redis versions below 4.1.135.Final or 4.2.15.Final.
Monitor PooledByteBufAllocatorMetric to track chunk allocation versus release rates and alert on sustained divergence.

Monitoring Recommendations

Export JVM direct-memory metrics to your observability stack and alert on monotonic growth over rolling windows.
Log and rate-limit TCP peers that repeatedly establish then abort Redis pipeline connections.
Correlate OutOfDirectMemoryError events with upstream connection patterns to identify abusive sources.

How to Mitigate CVE-2026-48006

Immediate Actions Required

Upgrade Netty to 4.1.135.Final or 4.2.15.Final in all affected applications and container images.
Audit transitive dependencies for older Netty versions pulled in by frameworks such as Vert.x, Spring, gRPC, or Lettuce.
Restart long-running JVMs after the upgrade to clear any already-leaked pooled chunks.

Patch Information

Netty maintainers released fixes in Netty 4.1.135.Final and Netty 4.2.15.Final. The patch adds the missing lifecycle hooks to RedisArrayAggregator so retained child buffers are released when the channel becomes inactive, the handler is removed, or an exception propagates. Full details are in the GitHub Security Advisory GHSA-6jv9-x5w9-2ccm.

Workarounds

Restrict Redis pipeline endpoints to trusted networks using firewall or service-mesh policies until the upgrade is deployed.
Configure idle-state and read-timeout handlers ahead of RedisArrayAggregator to terminate stalled aggregations predictably.
Schedule periodic JVM restarts on affected services to bound the impact of accumulated leaks.

bash

# Example Maven dependency override pinning a patched Netty version
mvn versions:use-dep-version \
  -Dincludes=io.netty:netty-codec-redis \
  -DdepVersion=4.1.135.Final \
  -DforceVersion=true