CVE-2026-44890
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in Netty (netty-codec-redis) before versions 4.1.135.Final and 4.2.15.Final allows a DoS attack by sending crafted Redis payloads without `\r\n` across multiple connections. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed.
Risk Assessment
The organization is exposed to denial of service (DoS), potentially causing unavailability of applications using Netty for Redis handling. The attack can be performed remotely without authentication, leveraging multiple connections.
Recommendation
Immediately update Netty to version 4.1.135.Final or 4.2.15.Final (or later). If an update is not possible, consider limiting the number of Redis connections or using a firewall to block suspicious packets.
Original NVD description (English source)
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.