{"id":"CVE-2026-93572","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-93572","summary":"## Summary\r\n\r\n`RedisArrayAggregator` recently added `maxElements` and `maxNestedArrayDepth` limits to fix public Redis resource-exhaustion advisories. The limits are independent, but…","details":"## Summary\r\n\r\n`RedisArrayAggregator` recently added `maxElements` and `maxNestedArrayDepth` limits to fix public Redis resource-exhaustion advisories. The limits are independent, but the allocator remains eager: every positive nested RESP array header creates `new ArrayList<RedisMessage>(length)` before any child element exists.\r\n\r\nWith the default constructor, an attacker can send nested array headers with length `1,000,000` until the default nesting limit of `1024` is reached. This can reserve up to `1,024,000,000` child slots from roughly 12 KB of RESP input. This is backing capacity, not logical list size: `ArrayList(int)` constructs an empty list with the specified initial capacity.\r\n\r\n## Technical Details\r\n\r\nCurrent `decodeRedisArrayHeader(...)` checks the two limits independently:\r\n\r\n```java\r\nif (header.length() > maxElements) {\r\n    throw new CodecException(\"this codec doesn't support longer length than \" + maxElements);\r\n}\r\n\r\nif (depths.size() >= maxNestedArrayDepth) {\r\n    releaseAndClearDepths();\r\n    throw new CodecException(\"max nested array depth exceeded: \"  + maxNestedArrayDepth);\r\n}\r\ndepths.push(new AggregateState((int) header.length()));\r\n```\r\n\r\n`AggregateState` i","published":"2026-09-18T11:17:21.900","modified":"2026-09-18T11:17:21.900","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-93572"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536963"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T11:17:21.900"}}