Skip to content
OpenAdvisories
High · 8.7 CVE-2026-48006 EUVD-2026-36492GHSA-6jv9-x5w9-2ccm

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

Published Jun 12, 2026 · Updated Sep 18, 2026 · Assigned by GitHub_M

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected products

VendorProductAffectedFixed
netty netty >= 4.2.0.Final, < 4.2.15.Final, < 4.1.135.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 netty No fix yet —
Debian 13 netty No fix yet —
Debian 12 netty No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Ubuntu 25.10 netty No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS netty No fix yet —
Ubuntu Pro 24.04 LTS netty No fix yet —
Ubuntu Pro 22.04 LTS netty No fix yet —
Ubuntu Pro 20.04 LTS netty No fix yet —
Ubuntu Pro 18.04 LTS netty No fix yet —
Ubuntu Pro 16.04 LTS netty No fix yet —
Ubuntu Pro 14.04 LTS netty No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Els 7 eap7-activemq-artemis +15 2.16.0-22.redhat_00057.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-glassfish-jsf 2.3.14-11.SP11_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-ironjacamar +8 1.5.26-2.Final_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jackson-core +10 2.18.8-1.redhat_00003.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-remoting 5.0.31-3.SP2_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-server-migration +2 1.10.0-46.Final_redhat_00044.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-netty +26 4.1.135-1.Final_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-api +7 2.5.5-24.SP12_redhat_00016.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-bindings +1 2.5.5-30.SP12_redhat_00020.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-undertow 2.2.40-1.SP3_redhat_00001.1.el8eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly +4 7.4.25-2.GA_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly-java-jdk17 7.4.25-2.GA_redhat_00001.1.el8eap RHSA-2026:53646, RHSA-2026:53645
ReleasePackageFixed inAdvisory
SLES 15 SP7 netty 4.1.135-150200.4.50.1 SUSE-SU-2026:2802-1
SLES 15 SP7 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
SLES 15 SP6 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
SLES 15 SP5 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
SLES 15 SP4 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
SLES for SAP 15 SP5 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
SLES for SAP 15 SP4 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
SLE HPC 15 SP5 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
SLE HPC 15 SP4 netty-tcnative 2.0.79-150200.3.45.1 SUSE-SU-2026:2802-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.135-1.1 openSUSE-SU-2026:11033-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling celeborn-0.6 0.6.3-r8 —
Wolfi rolling management-api-for-apache-cassandra-5.0 0.1.120-r0 —
Wolfi rolling tez 0.10.5-r15 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.2-r13 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-codec-redis >= 4.2.0.Final, < 4.2.15.Final 4.2.15.Final GHSA-6jv9-x5w9-2ccm
Maven io.netty:netty-codec-redis < 4.1.135.Final 4.1.135.Final GHSA-6jv9-x5w9-2ccm

Advisories 6

References