Netty’s RedisDecoder can consume unlimited direct memory when it receives multiple Redis payloads that omit the required \r\n terminator. The unchecked allocation results in an OutOfDirectMemoryError, which stops the application from handling any further connections and effectively disables the service for legitimate users. The vulnerability allows an attacker to trigger this failure by sending crafted messages, leading to a denial‑of‑service condition.

All instances of Netty that use netty-codec-redis versions prior to 4.1.135.Final or 4.2.15.Final are affected. Applications, servers, or services that embed these older Netty releases are at risk.

The CVSS score of 7.5 indicates a high severity; the lack of an EPSS score means the exploitation probability is unknown but could be moderate. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely observed in the wild yet. Attackers can exploit it remotely by sending malicious Redis payloads over the network to any publicly reachable Netty endpoint that processes Redis commands.