The RedisArrayAggregator component in io.netty:netty-codec-redis fails to clear retained partial aggregate state when the maxElements limit is exceeded during RESP array decoding. While exceeding maxNestedArrayDepth triggers cleanup, exceeding maxElements throws a CodecException without releasing retained ByteBuf references or clearing parser state. This leads to stale aggregate state persisting in the handler if the channel remains open after the exception. The vulnerability allows an unauthenticated peer to keep large pooled buffers pinned, potentially causing resource exhaustion until the channel is closed or the stale aggregate completes. The issue is confirmed in versions 4.1.135.Final, 4.2.15.Final, and the current 4.2 branch head. The suggested fix is to call releaseAndClearDepths() before throwing in the maxElements failure branch, aligning it with the existing nested-depth cleanup behavior.

An unauthenticated attacker can cause retained buffers and stale parser state to persist in the Redis codec handler after a maxElements limit exception. This can lead to resource exhaustion by pinning large pooled buffers (up to 512MB bulk strings) until the channel is closed or the stale aggregate completes. There is no direct confidentiality impact, but integrity is impacted due to stale parser state continuation. Availability impact is moderate due to potential resource exhaustion. Applications that close the channel or remove the handler on decoder exceptions are not affected by this issue. No known exploits are reported in the wild.

A patch is available that adds proper cleanup by calling releaseAndClearDepths() before throwing the CodecException on maxElements limit exceedance. Applications should update to a fixed version that includes this patch. If immediate patching is not possible, ensure that the channel or handler is closed or removed upon decoder exceptions to trigger existing cleanup and prevent stale state retention. Check the vendor advisory or repository for the official patch and apply it accordingly.