The RedisArrayAggregator handler in io.netty:netty-codec-redis versions >=4.2.0.Final <4.2.15.Final and <4.1.135.Final leaks pooled direct-memory buffers when Redis pipeline connections close before a RESP array aggregate completes. The handler retains child messages in its internal state but lacks channelInactive, handlerRemoved, or exceptionCaught methods to release these buffers upon pipeline teardown. Since the leaked buffers are slices of PooledByteBufAllocator chunks, they prevent these chunks from returning to the JVM-wide direct-memory pool. Repeated connection churn by any network peer causes a monotonic drain of this shared pool, eventually causing allocation failures on all Netty channels in the process, resulting in a denial of service. The vulnerability has a CVSS v3.1 score of 7.5 (high severity) with no confidentiality or integrity impact but high availability impact. A patch is available and has been released in netty versions 4.2.15.Final and 4.1.135.Final.

Exploitation of this vulnerability leads to a denial of service condition by exhausting the JVM-wide direct-memory pool used by Netty channels. This resource exhaustion prevents allocation of new buffers, causing failures across all Netty channels in the affected process. There is no impact on confidentiality or integrity, but availability is severely affected. This can disrupt applications relying on Netty for Redis communication, impacting their stability and uptime.

A patch is available and should be applied to upgrade affected versions to 4.2.15.Final or 4.1.135.Final or later. The vendor advisory indicates that no effective mitigation other than applying the fix meets their criteria for ease of use and applicability. Therefore, upgrading to a fixed version is the recommended remediation. There is no indication that any workaround or temporary mitigation is available or sufficient.