- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 6 · 4 high, 2 medium
- Dependents
- 228
- Registry
- Maven Central
Advisories 6
- CVE-2026-56818Medium 6.5
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
Affected: fixed in 4.1.136.Final; from 4.2.0-Final, fixed in 4.2.16.Final.
- CVE-2026-50011High 7.5
Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
- CVE-2026-48006High 8.7
Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
- CVE-2026-44890High 7.5
Netty has Unbounded Direct Memory Consumption in its RedisDecoder
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
- CVE-2026-44250High 7.5
Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
- CVE-2026-42586Medium 6.8
Netty: CRLF Injection in Netty Redis Codec Encoder
Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final.