io.netty:netty-codec-redis 4.2.0.Alpha3

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-codec-redis package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in `RedisArrayAggregator`. An attacker who sends a small RESP array header declaring a very large element count can force the aggregator to reserve a large `ArrayList` via the `AggregateState` constructor, before any child elements are sent, exhausting memory. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-redis` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Alpha1,4.2.15.Final)
H CRLF Injection Affected versions of this package are vulnerable to CRLF Injection in the `RedisEncoder` component. An attacker can inject arbitrary Redis commands or forge responses by supplying input containing CRLF sequences, which are not properly sanitized before being written to the network output buffer. This allows manipulation of the Redis protocol stream, potentially leading to unauthorized command execution or response poisoning. Note: This is only exploitable if user-controlled input is placed into `InlineCommandRedisMessage`, `SimpleStringRedisMessage`, or `ErrorRedisMessage` content, and the application does not perform its own CRLF sanitization before constructing these message objects. How to fix CRLF Injection? Upgrade `io.netty:netty-codec-redis` to version 4.1.133.Final, 4.2.13.Final or higher.	[,4.1.133.Final)[4.2.0.Alpha1,4.2.13.Final)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in RedisArrayAggregator. An attacker who sends a small RESP array header declaring a very large element count can force the aggregator to reserve a large ArrayList via the AggregateState constructor, before any child elements are sent, exhausting memory.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-redis to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Alpha1,4.2.15.Final)

CRLF Injection

Affected versions of this package are vulnerable to CRLF Injection in the RedisEncoder component. An attacker can inject arbitrary Redis commands or forge responses by supplying input containing CRLF sequences, which are not properly sanitized before being written to the network output buffer. This allows manipulation of the Redis protocol stream, potentially leading to unauthorized command execution or response poisoning.

Note:

This is only exploitable if user-controlled input is placed into InlineCommandRedisMessage, SimpleStringRedisMessage, or ErrorRedisMessage content, and the application does not perform its own CRLF sanitization before constructing these message objects.

How to fix CRLF Injection?

Upgrade io.netty:netty-codec-redis to version 4.1.133.Final, 4.2.13.Final or higher.

[,4.1.133.Final)[4.2.0.Alpha1,4.2.13.Final)

io.netty:netty-codec-redis@4.2.0.Alpha3

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically