Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
Impact
The RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (depths field) but defines no channelInactive, handlerRemoved, or exceptionCaught method to release them when the pipeline tears down. Because the leaked buffers are slices of PooledByteBufAllocator chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.netty:netty-codec-redis | >= 4.2.0.Final, < 4.2.15.Final, < 4.1.135.Final | 4.2.15.Final, 4.1.135.Final |
References
- https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm
- https://nvd.nist.gov/vuln/detail/CVE-2026-48006
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/security/cve/CVE-2026-48006
- https://bugzilla.redhat.com/show_bug.cgi?id=2488433
- https://github.com/netty/netty
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48006.json
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-401, CWE-772- Platform
- Java / Kotlin (Maven)
- Package
io.netty:netty-codec-redis- Disclosed
- 11.06.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6jv9-x5w9-2ccm - CC BY 4.0
Vulnerability history: io.netty:netty-codec-redis
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 05.2026 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 2
Disclosures per year
- 2026: 6
-
Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.