Vulnerability	Vulnerable Version
M Improper Check or Handling of Exceptional Conditions Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions in the `RedisArrayAggregator` process. An attacker can cause retained partial aggregate state to persist by sending a RESP array with a bulk-string child followed by a nested array header that exceeds the configured `maxElements` limit, resulting in a decoder exception without proper cleanup. This allows attacker-controlled aggregate state to remain alive across a security-limit exception, potentially pinning retained pooled buffers until the channel is closed or the handler is removed. How to fix Improper Check or Handling of Exceptional Conditions? Upgrade `io.netty:netty-codec-redis` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0-Final,4.2.16.Final)

Improper Check or Handling of Exceptional Conditions

Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions in the RedisArrayAggregator process. An attacker can cause retained partial aggregate state to persist by sending a RESP array with a bulk-string child followed by a nested array header that exceeds the configured maxElements limit, resulting in a decoder exception without proper cleanup. This allows attacker-controlled aggregate state to remain alive across a security-limit exception, potentially pinning retained pooled buffers until the channel is closed or the handler is removed.

How to fix Improper Check or Handling of Exceptional Conditions?

Upgrade io.netty:netty-codec-redis to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0-Final,4.2.16.Final)

Go back to all versions of this package