CVE-2026-48006 describes a resource leak vulnerability in the Netty io.netty:netty-codec-redis component, specifically in the RedisArrayAggregator handler. When a Redis pipeline connection closes before a RESP array aggregate completes, pooled direct-memory buffers are permanently leaked because the handler retains child messages in its 'depths' field but does not implement channel lifecycle cleanup methods such as channelInactive, handlerRemoved, or exceptionCaught to release these buffers. Since these buffers are slices of PooledByteBufAllocator chunks, the leak prevents these chunks from being returned to the JVM-wide direct-memory pool. This leads to a monotonic drain of the shared pool under repeated connection churn, ultimately causing allocation failures on all Netty channels within the process.

The vulnerability causes a denial of service condition by leaking pooled direct-memory buffers, which depletes the JVM-wide direct-memory pool. This resource exhaustion can lead to allocation failures on all Netty channels in the affected process, potentially disrupting network communications that rely on Netty. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor advisories for updates addressing this issue. In the meantime, mitigating connection churn or avoiding premature pipeline connection closures may reduce the impact.