CVE-2026-56818: netty

Vulnerability summary

CVE-2026-56818 is a medium (CVSS 6.5) vulnerability in netty. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-08-2026
   PublishedVulnerability first disclosed.
2. 08-08-2026
   Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

• CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
• CWE-703Improper Check or Handling of Exceptional ConditionsThe product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.