Homepage

Allocation of Resources Without Limits or Throttling The advisory has been revoked - it doesn't affect any version of package netty-codec-redis  (opens in a new tab)

Threat Intelligence

EPSS
0.85% (57th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-NETTYCODECREDIS-17339281
  • published15 Jun 2026
  • disclosed11 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 11 Jun 2026

CVE-2026-44250  (opens in a new tab)
CWE-770  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream netty-codec-redis package and not the netty-codec-redis package as distributed by RHEL.

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.