Netty’s netty-codec-redis library contains a flaw that enables an attacker able to send a specially crafted Redis payload with deeply nested arrays. When processed, the library allocates an enormous number of state objects and collections, exhausting the JVM heap and resulting in an OutOfMemoryError. The primary consequence is denial of service; the attacker gains no direct code execution or data exfiltration. This weakness is classified as an improper input validation problem (CWE-400) and an uncontrolled resource consumption problem (CWE-770).

The vulnerability affects the Netty framework, specifically the netty-codec-redis component. Versions prior to 4.1.135.Final (in the 4.1 series) and prior to 4.2.15.Final (in the 4.2 series) are vulnerable. Updating the library to these fixed releases mitigates the issue.

The CVSS score of 7.5 places the flaw in the high severity range. The vulnerability can be triggered by sending a crafted Redis payload with deeply nested arrays to a Netty-based Redis endpoint. Exploitation requires only network access to that endpoint and the ability to issue the payload. The EPSS score of 0.00038 (approximately 0.04%) indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The impact is a denial of service, as the server will exhaust JVM memory.