Security readout for executives and security teams
Plain-English summary
A flaw in the Netty networking library lets a remote attacker crash or freeze services that use its Redis protocol decoder. By sending malformed Redis messages that never end properly, the attacker forces the server to hoard memory until it can no longer accept legitimate users. No data is stolen, but the service becomes unavailable until restarted or patched.
Executive priority
Treat as a high-priority availability risk for any internet-facing service that speaks the Redis protocol via Netty. Schedule patching in the current maintenance window; there is no data-loss or breach exposure, but a single attacker can knock affected services offline with modest effort.
Technical view
In netty-codec-redis before 4.1.135.Final and 4.2.15.Final, RedisDecoder buffers inbound bytes waiting for a terminating `\r\n`. An attacker opening many connections and streaming payloads without the delimiter causes unbounded growth of the direct memory pool, ultimately triggering OutOfDirectMemoryError. This is a CWE-400/CWE-770 uncontrolled resource consumption issue, CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/A:H). Fixed versions bound the buffered state.
Likely exposure
Applications, gateways, and proxies built on Netty that expose the Redis decoder to untrusted network input, including services accepting Redis protocol traffic from the internet or from less-trusted internal tenants. Purely internal, authenticated Redis clients using Netty are less exposed but still at risk if attackers can reach the listener.
Exploitation context
No active exploitation is reported and the CVE is not in CISA KEV. The GitHub Security Advisory (GHSA-6ghj-frrj-jjj3) and Red Hat advisory describe the DoS pattern conceptually; no public exploit code is cited in the bundle. Impact is availability only, network-reachable, and unauthenticated per the CVSS vector.
Researcher notes
Root cause is unbounded accumulation in RedisDecoder when the `\r\n` framing token never arrives, so buffered ByteBufs are never released. Multiplied across many connections, this drains the pooled direct memory arena. Validate fixes by reviewing the 4.1.135.Final and 4.2.15.Final release notes and the GHSA advisory. Sources do not enumerate downstream products; check shaded Netty in Spring, Vert.x, Quarkus, and Cassandra-family builds.
Mitigation direction
- Upgrade netty-codec-redis to 4.1.135.Final or 4.2.15.Final across all services and container images.
- Apply Red Hat RHSA-2026:37390 or vendor equivalent to affected platform components.
- Restrict network exposure of Redis-decoder listeners to trusted sources via firewalls or service mesh policy.
- Set direct memory and connection limits on Netty-based services to contain resource exhaustion.
- Rebuild and redeploy downstream artifacts that shade or embed vulnerable Netty versions.
Validation and detection
- Inventory dependencies with an SBOM or `mvn dependency:tree`/`gradle dependencies` search for netty-codec-redis versions.
- Confirm running services report Netty 4.1.135.Final or 4.2.15.Final at startup or via management endpoints.
- Scan container images and artifact registries for pre-fix Netty versions using SCA tooling.
- Review Red Hat CSAF/VEX data for platform-specific fix availability and status.
- Monitor Netty-based services for OutOfDirectMemoryError and abnormal direct memory growth after patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-44890 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6GitHub_MCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-06-11T22:00:53.322Z: Reported to Red Hat.
- 2026-06-11T20:52:50.980Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/netty/netty/releases/tag/netty-4.1.135.FinalCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.15.FinalCVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-44890CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2488053CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44890.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:37390CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.