CVE-2026-93572 is a denial of service vulnerability in Netty's RedisArrayAggregator component. An attacker can exploit this by sending nested Redis protocol array headers crafted to cause the RedisArrayAggregator to preallocate excessive heap memory. This results in heap memory exhaustion and application unavailability for systems using RedisDecoder with RedisArrayAggregator on untrusted input. The vulnerability affects multiple specific Netty package versions as listed. Red Hat products that use Netty Redis pipelines, such as JBoss Fuse, Enterprise Application Platform, and Red Hat Single Sign-On, are impacted. The issue is due to multiplication of independent limits on array elements and nested array depth, leading to resource exhaustion. The vulnerability has a CVSS 3.1 score of 7.5 (medium severity) with network attack vector, low complexity, no privileges required, and high availability impact. Vendor advisories provide fixed versions and remediation guidance.

The vulnerability enables remote attackers to cause heap memory exhaustion in affected applications by sending specially crafted nested Redis array headers. This results in denial of service (DoS) conditions due to excessive memory preallocation. There is no impact on confidentiality or integrity, only availability is affected. Applications using Netty Redis pipelines on untrusted traffic are vulnerable, including certain Red Hat products. No known exploits in the wild have been reported.

Fixed versions and remediation guidance are available from the Netty project advisory at https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg. Users should upgrade to these fixed versions to address the vulnerability. No vendor advisory indicates that the issue is already mitigated or requires no action. Therefore, applying the official fix is recommended. For Red Hat products, monitor Red Hat advisories for patches or updates. Avoid processing untrusted Redis protocol traffic with vulnerable versions if possible until patched.