Threats tagged 'ghsa-p9jm-q85p-7mcp'

A vulnerability in Netty's RedisArrayAggregator component causes retained partial aggregate state to persist after a max-elements limit exception. This occurs because the handler fails to clear retained state when the maxElements limit is exceeded, unlike the maxNestedArrayDepth limit which triggers cleanup. An unauthenticated peer can exploit this by sending crafted RESP arrays, causing retained buffers to persist until channel closure or later message completion. This can lead to resource retention and potential denial of service. The issue affects io.netty:netty-codec-redis versions before 4.1.136.Final and from 4.2.0-Final up to but excluding 4.2.16.Final. A fix is available in versions 4.1.136.Final and 4.2.16.Final.