The vulnerability in RedisArrayAggregator involves allocation of resources without sufficient combined throttling. Although maxElements and maxNestedArrayDepth limits exist independently, the allocator eagerly creates new ArrayList instances with initial capacities equal to the nested array lengths before processing child elements. An attacker can exploit this by sending nested array headers with very large lengths (e.g., 1,000,000) up to the nesting limit (default 1024), resulting in reservation of over one billion child slots from minimal input data. This excessive preallocation can cause significant memory consumption leading to denial of service. The decodeRedisArrayHeader method checks limits independently and throws exceptions when limits are exceeded, but the eager allocation occurs before these checks fully mitigate the issue. The vulnerability is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling).

An attacker can cause a denial of service by triggering excessive memory allocation in the RedisArrayAggregator component, potentially exhausting system resources and impacting availability. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without privileges or user interaction.

Red Hat references a fix available in the upstream Netty project (see https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg) and recommends applying those fixed versions. Users should consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93572 for specific remediation guidance and fixed product versions. Patch status is not explicitly stated in the provided advisory content; therefore, check the vendor advisory for current remediation guidance. No vendor advisory states that no action is required or that the issue is already mitigated without patching.