Netty’s RedisArrayAggregator pre‑allocates an ArrayList whose capacity is set to the RESP array element count read from the wire. A malicious client can send a header that claims an excessively large count, causing the framework to allocate a huge internal array before any child messages are processed. This uncontrolled resource allocation can lead to out‑of‑memory conditions and crash or stall the server, resulting in loss of service for legitimate users.

The vulnerability affects the Netty network application framework, specifically versions prior to 4.1.135.Final and 4.2.15.Final. Users running any Netty deployment that parses the Redis protocol are at risk unless their application is patched to a newer release.

The CVSS score of 7.5 classifies the flaw as a high‑severity vulnerability. Exploitation requires the ability to send forged RESP array headers to a Netty server; whether an attacker needs to authenticate before sending such headers is not specified in the CVE data. Because the EPSS is not available, the exact likelihood of exploitation is unknown, and the flaw is not yet listed in CISA’s KEV catalog, but the large potential impact warrants caution. An attacker could trigger memory exhaustion and cause a denial of service, impacting availability for all users of the affected service.