io.netty:netty-codec-redis 4.1.70.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-codec-redis package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Check or Handling of Exceptional Conditions Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions in the `RedisArrayAggregator` process. An attacker can cause retained partial aggregate state to persist by sending a RESP array with a bulk-string child followed by a nested array header that exceeds the configured `maxElements` limit, resulting in a decoder exception without proper cleanup. This allows attacker-controlled aggregate state to remain alive across a security-limit exception, potentially pinning retained pooled buffers until the channel is closed or the handler is removed. How to fix Improper Check or Handling of Exceptional Conditions? Upgrade `io.netty:netty-codec-redis` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0-Final,4.2.16.Final)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in `RedisArrayAggregator`. An attacker who sends a small RESP array header declaring a very large element count can force the aggregator to reserve a large `ArrayList` via the `AggregateState` constructor, before any child elements are sent, exhausting memory. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-redis` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Alpha1,4.2.15.Final)
H Missing Release of Memory after Effective Lifetime Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime due to improper cleanup of pooled direct-memory buffers in the `RedisArrayAggregator` function. An attacker can exhaust the JVM-wide direct-memory pool by repeatedly opening and closing pipeline connections before a RESP array aggregate completes, leading to allocation failures across all channels. How to fix Missing Release of Memory after Effective Lifetime? Upgrade `io.netty:netty-codec-redis` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)
H Denial of Service (DoS) Affected versions of this package are vulnerable to Denial of Service (DoS) in the `RedisArrayAggregator` function. An attacker can exhaust system memory by sending specially crafted Redis payloads containing deeply nested arrays, resulting in allocation of excessive state objects and collections. How to fix Denial of Service (DoS)? Upgrade `io.netty:netty-codec-redis` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `decodeLength` function. An attacker can exhaust the server's direct memory pool by sending continuous streams of digits without a terminating `\r\n` across multiple concurrent connections, which prevents legitimate connections from being processed. Note: This is only exploitable if an attacker is able to open multiple concurrent connections and distribute unbounded payloads among them. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-redis` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)
H CRLF Injection Affected versions of this package are vulnerable to CRLF Injection in the `RedisEncoder` component. An attacker can inject arbitrary Redis commands or forge responses by supplying input containing CRLF sequences, which are not properly sanitized before being written to the network output buffer. This allows manipulation of the Redis protocol stream, potentially leading to unauthorized command execution or response poisoning. Note: This is only exploitable if user-controlled input is placed into `InlineCommandRedisMessage`, `SimpleStringRedisMessage`, or `ErrorRedisMessage` content, and the application does not perform its own CRLF sanitization before constructing these message objects. How to fix CRLF Injection? Upgrade `io.netty:netty-codec-redis` to version 4.1.133.Final, 4.2.13.Final or higher.	[,4.1.133.Final)[4.2.0.Alpha1,4.2.13.Final)

Vulnerability

Vulnerable Version

Improper Check or Handling of Exceptional Conditions

Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions in the RedisArrayAggregator process. An attacker can cause retained partial aggregate state to persist by sending a RESP array with a bulk-string child followed by a nested array header that exceeds the configured maxElements limit, resulting in a decoder exception without proper cleanup. This allows attacker-controlled aggregate state to remain alive across a security-limit exception, potentially pinning retained pooled buffers until the channel is closed or the handler is removed.

How to fix Improper Check or Handling of Exceptional Conditions?

Upgrade io.netty:netty-codec-redis to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0-Final,4.2.16.Final)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in RedisArrayAggregator. An attacker who sends a small RESP array header declaring a very large element count can force the aggregator to reserve a large ArrayList via the AggregateState constructor, before any child elements are sent, exhausting memory.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-redis to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Alpha1,4.2.15.Final)

Missing Release of Memory after Effective Lifetime

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime due to improper cleanup of pooled direct-memory buffers in the RedisArrayAggregator function. An attacker can exhaust the JVM-wide direct-memory pool by repeatedly opening and closing pipeline connections before a RESP array aggregate completes, leading to allocation failures across all channels.

How to fix Missing Release of Memory after Effective Lifetime?

Upgrade io.netty:netty-codec-redis to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) in the RedisArrayAggregator function. An attacker can exhaust system memory by sending specially crafted Redis payloads containing deeply nested arrays, resulting in allocation of excessive state objects and collections.

How to fix Denial of Service (DoS)?

Upgrade io.netty:netty-codec-redis to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the decodeLength function. An attacker can exhaust the server's direct memory pool by sending continuous streams of digits without a terminating \r\n across multiple concurrent connections, which prevents legitimate connections from being processed.

Note:

This is only exploitable if an attacker is able to open multiple concurrent connections and distribute unbounded payloads among them.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-redis to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

CRLF Injection

Affected versions of this package are vulnerable to CRLF Injection in the RedisEncoder component. An attacker can inject arbitrary Redis commands or forge responses by supplying input containing CRLF sequences, which are not properly sanitized before being written to the network output buffer. This allows manipulation of the Redis protocol stream, potentially leading to unauthorized command execution or response poisoning.

Note:

This is only exploitable if user-controlled input is placed into InlineCommandRedisMessage, SimpleStringRedisMessage, or ErrorRedisMessage content, and the application does not perform its own CRLF sanitization before constructing these message objects.

How to fix CRLF Injection?

Upgrade io.netty:netty-codec-redis to version 4.1.133.Final, 4.2.13.Final or higher.

[,4.1.133.Final)[4.2.0.Alpha1,4.2.13.Final)

io.netty:netty-codec-redis@4.1.70.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically