Resource Exhaustion in RedisArrayAggregator

CVE-2026-93572 is a resource exhaustion vulnerability affecting the RedisArrayAggregator component. The issue stems from the eager allocation of ArrayList capacity based on nested RESP array headers. The implementation checks 'maxElements' and 'maxNestedArrayDepth' independently, failing to account for the cumulative memory impact of nested array allocations. An attacker can send a series of nested RESP array headers, each specifying a large length, which forces the application to create 'new ArrayList<RedisMessage>(length)' for every header. Because the memory is reserved upon receipt of the header before the actual array elements are processed, an attacker can consume massive amounts of system memory with a relatively small input payload, leading to a Denial of Service (DoS) state. This vulnerability highlights the risk of relying on independent limit checks in recursive parsing logic.

Impact

Successful exploitation results in a Denial of Service due to memory exhaustion. The vulnerability allows an attacker to disproportionately consume system memory relative to the size of the malicious input, which can crash the application or destabilize the host system depending on the available heap space and resource constraints.

Recommendation

1. Audit applications utilizing RedisArrayAggregator to determine if user-controlled input can reach the affected RESP decoding logic.
2. Implement strict input validation or application-level rate limiting for incoming RESP traffic until a patch is available.
3. Monitor application memory usage and heap allocation patterns; unusual spikes correlated with high-frequency incoming array headers may indicate exploitation attempts.