AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-p9jm-q85p-7mcp: Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

mediumvulnerability

security

Source: GitHub Advisory DatabaseAugust 7, 2026CVE-2026-56818

Summary

A bug in Netty's RedisArrayAggregator (a component that processes Redis protocol messages) fails to clean up partial data when the maxElements limit is exceeded. If a connection stays open after this error, an attacker can send additional messages that get consumed into the leftover partial data, potentially causing memory to be retained or allowing unexpected message processing.

Solution / Mitigation

Call `releaseAndClearDepths()` before throwing from the max-elements branch. Consider applying the same cleanup to all unrecoverable `decodeRedisArrayHeader(...)` error exits that can occur while `depths` is non-empty.

Vulnerability Details

EPSS (30-day exploit probability)

EPSS: 0.0%

Patch Available

Yes

Disclosure Date

August 7, 2026

Classification

Attack SophisticationModerate

Affected Packages

io.netty:netty-codec-redis@>= 4.2.0-Final, < 4.2.16.Final (fixed: 4.2.16.Final)io.netty:netty-codec-redis@< 4.1.136.Final (fixed: 4.1.136.Final)

Monthly digest — independent AI security research

Original source: https://github.com/advisories/GHSA-p9jm-q85p-7mcp

First tracked: August 7, 2026 at 02:00 PM

Classified by LLM (prompt v3) · confidence: 95%