CVE-2026-93572

Executive Summary

CVE-2026-93572 is an uncontrolled resource-consumption (memory exhaustion) vulnerability in the RedisArrayAggregator component, which exposes maxElements and maxNestedArrayDepth limits that are enforced independently but do not constrain the allocator's eager backing-capacity reservations. An unauthenticated remote attacker can send crafted nested RESP array headers to force excessive heap allocation from a very small input payload. Successful exploitation can degrade or deny service availability on any system parsing untrusted RESP data through the affected codec.

Technical Analysis

The vulnerability resides in the RESP (REgistered/REdis Serialization Protocol) decoding logic of RedisArrayAggregator. Two independent safeguards were recently introduced to address previously disclosed public Redis resource-exhaustion advisories:

• maxElements — caps the declared length of a single array header.
• maxNestedArrayDepth — caps the depth of nested array headers (default 1024).

The decodeRedisArrayHeader(...) routine validates these limits as shown in the NVD description:

if (header.length() > maxElements) {
    throw new CodecException("this codec doesn't support longer length than " + maxElements);
}

if (depths.size() >= maxNestedArrayDepth) {
    releaseAndClearDepths();
    throw new CodecException("max nested array depth exceeded: "  + maxNestedArrayDepth);
}
depths.push(new AggregateState((int) header.length()));

The core flaw is that the allocator is eager. When a positive nested RESP array header is decoded, the codec constructs new ArrayList<RedisMessage>(length) before any child element exists. This preallocates backing capacity equal to the declared length. The key distinction, emphasized in the advisory, is that this is backing capacity, not logical list size — ArrayList(int) constructs an empty list with the specified initial capacity but no elements.

Because the two limits are checked independently rather than in combination, a header length can be up to (but not exceeding) maxElements even after nesting has already accumulated, provided the depth check has not yet tripped. With the default constructor, maxNestedArrayDepth defaults to 1024. An attacker can therefore send nested array headers each declaring a length of 1,000,000, repeating until the nesting limit of 1024 is reached. That yields approximately:

1024 × 1,000,000 = 1,024,000,000 child slots reserved

This ~1.024 billion-slot reservation is driven from roughly 12 KB of RESP input, an enormous amplification ratio between bytes sent and memory reserved (on the order of tens of thousands to one, depending on slot width and list overhead). Each ArrayList also carries per-instance object overhead, so real heap consumption exceeds the raw slot count.

CWE-770 (Allocation of Resources Without Limits or Throttling) is the assigned weakness class. The missing control is a joint/aggregate budget: the decoder must consider cumulative reserved capacity across the current nesting stack, not merely per-header length and per-stack depth in isolation. There is no per-message, per-connection, or global memory ceiling gating the eager ArrayList preallocation.

Affected component details beyond the class/method names appearing in the description are not available; further implementation specifics are insufficient in the provided data.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available. The attack chain below is inferred at the vulnerability-class level (resource exhaustion via unbounded allocation) and uses only identifiers present in the NVD description.

1. Reconnaissance / target identification. Identify a service endpoint that decodes untrusted RESP input through the affected RedisArrayAggregator codec — for example, a client, proxy, gateway, or bridge that accepts RESP from an untrusted peer and feeds it into this aggregator. The attacker needs only network reachability to such a decode path; no authentication is implied by the description.

2. Triggering the flaw class. The attacker crafts a RESP stream consisting of nested array headers, each declaring a large positive length (up to maxElements, e.g. 1,000,000), nested repeatedly. Critically, the attacker does not need to supply the child elements — the allocator reserves the backing capacity upon header decode, before children exist.

3. Payload / execution method. Sending this compact RESP input (roughly 12 KB per the analysis) causes the decoder to allocate new ArrayList<RedisMessage>(length) at each nesting level via AggregateState. Because the maxElements and maxNestedArrayDepth checks are independent, the attacker walks the depth up to the default 1024, compounding the reservation at every level until ~1,024,000,000 child slots are reserved.

4. Post-exploitation impact. The result is heap pressure — potential OutOfMemoryError, garbage-collection thrashing, latency spikes, or process/service termination. This is primarily an availability impact. There is no evidence in the provided data of confidentiality or integrity compromise, code execution, or data exfiltration associated with this flaw. Repeated or concurrent attempts can sustain denial of service against the decoding service.

Impact Assessment

The impact is availability-focused. Based on the assigned weakness and mechanism, the reasonable CVSS subscore profile is:

• Availability (A): High — the vulnerability directly enables memory exhaustion and service degradation/DoS.
• Confidentiality (C): None — no data exposure described.
• Integrity (I): None — no data modification described.
• Attack Vector (AV): Network — RESP input arrives over the network.
• Attack Complexity (AC): Low — a single crafted stream triggers the condition.
• Privileges Required (PR): None and User Interaction (UI): None are implied by the description (the decoder reserves capacity from input alone).

Note: No official CVSS score or vector was provided (N/A), and no EPSS score is available. The vector and subscores above are estimated from the described mechanism and must not be treated as authoritative.

Blast radius depends on where the codec is deployed. Any system that decodes untrusted RESP via RedisArrayAggregator with the default configuration is potentially affected. Because the amplification is large from a small payload, an attacker with low bandwidth can generate disproportionate memory pressure. Shared infrastructure (proxies, message bridges, multi-tenant services) amplifies the impact, as a single decoding process failure may affect many downstream clients. No specific affected version ranges, products, or vendor advisory are available in the provided data.

Detection Guidance

Sigma Rule

title: Potential RedisArrayAggregator RESP Nested Array Resource Exhaustion (CVE-2026-93572)
id: 9f2c1a44-7d3e-4b91-9a10-cve202693572
status: experimental
description: Detects memory-exhaustion symptoms consistent with crafted nested RESP array headers processed by RedisArrayAggregator.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93572
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: java
detection:
  selection_exception:
    message|contains:
      - 'max nested array depth exceeded'
      - "this codec doesn't support longer length than"
  selection_memory:
    message|contains|all:
      - 'OutOfMemoryError'
      - 'RedisMessage'
  condition: selection_exception or selection_memory
falsepositives:
  - Legitimate codec limit enforcement during normal operation
  - Application errors containing similar strings
level: medium
tags:
  - attack.t1499
  - cwe.770

YARA Rule

rule CVE_2026_93572_RedisArrayAggregator_Resource_Exhaustion
{
    meta:
        description = "Detects strings associated with CVE-2026-93572 RedisArrayAggregator resource exhaustion indicators"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93572"
        date = "2026-01-01"
        cve = "CVE-2026-93572"

    strings:
        $a = "max nested array depth exceeded"
        $b = "this codec doesn't support longer length than"
        $c = "RedisArrayAggregator"
        $d = "AggregateState"
        $e = "RedisMessage"

    condition:
        uint32(0) == 0xCAFEBABE and any of ($a, $b, $c, $d, $e)
}

Suricata IDS Rule

alert tcp any any -> any 6379 (msg:"CVE-2026-93572 RedisArrayAggregator potential nested RESP array resource exhaustion"; flow:established,to_server; content:"*"; depth:1; byte_test:0,>,0,0,string,dec,relative; threshold:type both, track by_src, count 64, seconds 10; classtype:attempted-dos; reference:cve,2026-93572; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93572; sid:202693572; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where event.category == "process" and process.thread.name != null and
     message like~ "max nested array depth exceeded"]
  [process where event.category == "process" and
     (message like~ "*OutOfMemoryError*" or message like~ "*RedisMessage*")]

Splunk SPL Query

index=application sourcetype=java:* ("max nested array depth exceeded" OR "this codec doesn't support longer length than" OR "OutOfMemoryError")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, sourcetype
| where count > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="redis,resource_exhaustion,cve_2026_93572,">
  <rule id="202693572" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">max nested array depth exceeded</field>
    <description>CVE-2026-93572: Possible RedisArrayAggregator RESP nested array resource-exhaustion attempt detected.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="202693573" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">OutOfMemoryError</field>
    <description>CVE-2026-93572: Java OutOfMemoryError possibly linked to RedisArrayAggregator eager allocation.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix or workaround has been identified, and no affected version ranges are published.

1. Immediate mitigations.

   • Do not expose RESP-decoding services that use RedisArrayAggregator to untrusted networks. Restrict reachability with network segmentation, firewalls, and access control lists.
   • Where configurably possible, lower maxElements and maxNestedArrayDepth to the minimum values compatible with legitimate workloads, reducing the worst-case reservation (maxElements × maxNestedArrayDepth).
   • Apply process-level memory limits / heap ceilings (e.g., JVM -Xmx, container memory limits) so exhaustion is contained and cannot destabilize the host.
   • Enforce per-connection input rate limits and overall connection caps to blunt automated attempts.

2. Patch / upgrade steps.

   • No vendor patch is available at this time. Monitor the vendor's security advisories and the NVD record for CVE-2026-93572 for a fix.
   • When a patch is released, validate that it introduces a joint/aggregate allocation budget (cumulative reserved capacity across the nesting stack) rather than merely tightening the two independent limits.
   • Re-test after upgrade using benign deep-nesting inputs to confirm that eager ArrayList reservations are bounded.

3. Long-term hardening.

   • Prefer lazy allocation in decoders — avoid new ArrayList(length) from an untrusted header; grow the list as real child elements arrive.
   • Implement global and per-connection memory budgets for decode paths, with fail-closed behavior.
   • Treat all RESP headers from untrusted peers as attacker-controlled; validate declared lengths against cumulative resource counters, not just single-header maxima.
   • Add monitoring/alerting on the exception strings and OutOfMemoryError conditions shown in the detection rules to catch attempts early.

References

• NVD — CVE-2026-93572: https://nvd.nist.gov/vuln/detail/CVE-2026-93572
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Redis Security Advisories / RESP protocol documentation: https://redis.io/docs/latest/develop/reference/protocol-spec/
• FIRST EPSS (no score currently available for this CVE): https://www.first.org/epss/

Threat actor / exploit-in-the-wild status: No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template were identified in the provided data. There is no evidence of active exploitation or known threat-actor campaigns at the time of writing. This section should be updated if new intelligence emerges.