CVE-2026-48006— Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

N/A

在移除最后引用时对内存的释放不恰当(内存泄露)

Netty 资源管理错误漏洞

Netty是Netty团队开源的一款非阻塞I/O客户端-服务器框架, 它主要用于开发Java网络应用程序,如协议服务器和客户端等。 Netty 4.1.135.Final之前版本和4.2.15.Final之前版本存在安全漏洞，该漏洞源于RedisArrayAggregator处理程序在处理Redis管道连接时，当RESP数组聚合未完成前连接关闭，会导致池化直接内存缓冲区永久泄漏，从而可能导致分配失败。

N/A

N/A