CyberRota Analysis
AI-GeneratedThe vulnerability affects the Java implementation of `RedisArrayAggregator`, which can be exploited by sending deeply nested RESP array headers with excessively large lengths, leading to significant resource exhaustion. This can result in the allocation of up to 1,024,000,000 child slots, potentially overwhelming server resources and causing denial of service. Organizations using this Java component in their Redis implementations should prioritize addressing this vulnerability to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic.