CVE-2026-93572: Netty RedisArrayAggregator DoS Vulnerability

CVE-2026-93572 Overview

CVE-2026-93572 is a denial of service vulnerability in Netty's RedisArrayAggregator component. A remote attacker can send crafted nested Redis Serialization Protocol (RESP) array headers to force eager preallocation of large heap buffers. The condition triggers heap memory exhaustion in applications using RedisDecoder with RedisArrayAggregator on untrusted traffic. The weakness is tracked as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
Unauthenticated network attackers can exhaust JVM heap memory and crash applications that decode Redis protocol traffic from untrusted sources.

Affected Products

Netty RedisArrayAggregator component
Applications using RedisDecoder with RedisArrayAggregator
Downstream distributions tracked by Red Hat (see vendor advisory)

Discovery Timeline

2026-09-18 - CVE-2026-93572 published to the National Vulnerability Database
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-93572

Vulnerability Analysis

The flaw resides in Netty's Redis protocol decoding pipeline. The RedisArrayAggregator reads the length field of an incoming RESP array header and preallocates internal structures sized to that value. When arrays are nested, each header adds another allocation, and none of them are validated against actual bytes present on the wire.

A remote attacker exploits this by sending a small payload containing deeply nested arrays with very large declared lengths. The decoder accepts the header values as authoritative and reserves memory before any element is delivered. Applications running on shared JVMs may crash with OutOfMemoryError and take colocated services down.

The vulnerability requires network access, no authentication, and no user interaction. Confidentiality and integrity remain intact; the impact is limited to availability.

Root Cause

The root cause is unbounded resource allocation driven by attacker-controlled protocol metadata. RedisArrayAggregator trusts the declared array size in the RESP header and eagerly reserves heap capacity without enforcing a maximum aggregate size or verifying that sufficient input bytes exist.

Attack Vector

An attacker connects to any service that pipes untrusted network traffic through RedisDecoder and RedisArrayAggregator. The attacker sends nested RESP array headers such as *2147483647\r\n chained through several levels. Each header inflates the preallocation, and repeated connections compound the memory pressure until the process fails.

See the Red Hat CVE-2026-93572 Advisory and Red Hat Bug Report #2536963 for protocol-level references.

Detection Methods for CVE-2026-93572

Indicators of Compromise

Sudden java.lang.OutOfMemoryError: Java heap space events in application logs tied to Netty pipeline threads
Repeated inbound TCP connections carrying short payloads that begin with RESP array markers (*) followed by very large integers
Abnormal JVM heap growth followed by garbage collection thrashing on services that terminate Redis protocol traffic

Detection Strategies

Inspect network traffic to RedisDecoder endpoints for RESP array headers declaring lengths near Integer.MAX_VALUE or containing multiple nested * prefixes
Correlate Netty pipeline exceptions such as RedisCodecException and OutOfMemoryError with source IP addresses to identify abusive clients
Monitor JVM metrics for rapid heap allocation spikes coincident with new inbound connections on Redis ports

Monitoring Recommendations

Enable JVM heap and GC telemetry with alerting thresholds tuned for baseline memory usage
Forward Netty exception stack traces to a centralized logging pipeline for pattern matching on RedisArrayAggregator frames
Track connection rate and payload size distribution on any listener that decodes RESP messages

How to Mitigate CVE-2026-93572

Immediate Actions Required

Upgrade Netty to a fixed release as identified in the Red Hat CVE-2026-93572 Advisory
Restrict exposure of RedisDecoder endpoints to trusted network segments until patching completes
Enforce per-connection payload and rate limits at the load balancer or reverse proxy

Patch Information

Refer to the Red Hat CVE-2026-93572 Advisory and Red Hat Bug Report #2536963 for fixed package versions across affected distributions. Rebuild and redeploy any application shading a vulnerable copy of io.netty:netty-codec-redis.

Workarounds

Remove RedisArrayAggregator from Netty pipelines that process untrusted input and perform array assembly at the application layer with explicit size checks
Terminate Redis protocol connections behind an authenticated proxy so only trusted clients reach the decoder
Cap JVM heap and configure container memory limits so a single crashed process does not affect neighboring workloads

bash

# Configuration example
# Verify the Netty codec-redis version in a Maven project
mvn dependency:tree -Dincludes=io.netty:netty-codec-redis

# Enforce a maximum request size upstream (example: HAProxy)
# frontend redis_fe
#   bind *:6379
#   tcp-request content reject if { req.len gt 4096 }