CVE-2026-56818

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

• CWE-401
• CWE-703

• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bPatch
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6Patch
• https://github.com/netty/netty/pull/17065Issue Tracking, Patch
• https://github.com/netty/netty/security/advisories/GHSA-p9jm-q85p-7mcpExploit, Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-p9jm-q85p-7mcpExploit, Vendor Advisory

Published

Aug 7, 2026

Last Modified

Sep 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56812Improper Check for Unusual or Exceptional Conditions vulnera…7.5
• CVE-2026-56813Improper Neutralization of Parameter/Argument Delimiters vul…2.1
• CVE-2026-56814Plug.Parsers.MULTIPART, the multipart request-body parser us…6.9
• CVE-2026-56815pwnlift before d7a9544, in a privileged deployment, contains…7.4
• CVE-2026-56816Netty is a network application framework for development of …7.5
• CVE-2026-56817Netty is a network application framework for development of …9.8
• CVE-2026-56819Netty is a network application framework for development of …7.5
• CVE-2026-5682A vulnerability has been found in Meesho Online Shopping App…3.7
• CVE-2026-56820Netty is a network application framework for development of …9.1
• CVE-2026-56821Netty is an asynchronous, event-driven network application f…7.4
• CVE-2026-56822Netty is an asynchronous, event-driven network application f…7.4
• CVE-2026-56823AutoGPT is a workflow automation platform for creating, depl…5.4