CVE-2026-56818: Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
RedisArrayAggregator clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk-string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception, but the existing partial aggregate remains retained in the handler.
If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate. The supplied PoV proves both the retained ByteBuf reference and the stale parser state continuation.
References
- github.com/advisories/GHSA-p9jm-q85p-7mcp
- github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- github.com/netty/netty/pull/17065
- github.com/netty/netty/security/advisories/GHSA-p9jm-q85p-7mcp
- nvd.nist.gov/vuln/detail/CVE-2026-56818
Code Behaviors & Features
Detect and mitigate CVE-2026-56818 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →