---
id: CVE-2026-44890
title: >-
  Netty is a network application framework for development of protocol servers
  and clients
summary: >-
  Netty is a network application framework for development of protocol servers
  and clients. In netty-codec-redis prior to versions 4.1.135.Final and
  4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads
  across multiple …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-770
vendor: netty
product: netty
affected:
  - netty < 4.1.135
  - 'netty >= 4.2.0, < 4.2.15'
patched:
  - netty 4.2.15
published: '2026-06-11'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T13:18:24.623'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44890'
references:
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.1.135.Final'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.2.15.Final'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3'
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:37390'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:41951'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:50085'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:53644'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:53645'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:53646'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44890'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2488053'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44890.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:53806'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44890'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44890'
  - url: 'https://github.com/advisories/GHSA-6ghj-frrj-jjj3'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - maven
epss: 0.00461
epssPercentile: 0.39228
aliases:
  - GHSA-6ghj-frrj-jjj3
ecosystem: maven
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-12T10:05:11.294129Z'
ingestedAt: '2026-07-07T15:41:59.865Z'
---

## Overview

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

## Affected

- `netty < 4.1.135`
- `netty >= 4.2.0, < 4.2.15`

## Remediation

Upgrade past the affected range:

- `netty 4.2.15`

## Package advisory (CVE-2026-44890)

Affected packages:

- `io.netty:netty-codec-redis >= 4.2.0.Final, <= 4.2.14.Final`
- `io.netty:netty-codec-redis <= 4.1.134.Final`

Patched in:

- `io.netty:netty-codec-redis 4.2.15.Final`
- `io.netty:netty-codec-redis 4.1.135.Final`

Source: https://github.com/advisories/GHSA-6ghj-frrj-jjj3

## Vendor advisories

- **RHSA-2026:53644** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53644)
- **RHSA-2026:41951** · Red Hat · fixed in: Red Hat Data Grid 8.6.2 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41951)
- **RHSA-2026:53806** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.4.25 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53806)
- **RHSA-2026:50085** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8.1 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50085)
- **RHSA-2026:37390** · Red Hat · fixed in: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37390)
- **Red Hat VEX** · Important · affected: Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack · no fix planned: Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44890.json)
- **RHSA-2026:53645** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 8 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53645)
- **RHSA-2026:53646** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53646)