CVE-2026-42586: Netty Redis codec CRLF injection in RedisEncoder

Executive brief

Netty, a popular networking framework for Java, contains a vulnerability in its Redis protocol component. This flaw allows an attacker to inject unauthorized Redis commands or forge server responses by including special line-break characters in data sent to the application. This could lead to unauthorized data access, modification of database settings, or the deletion of all stored data.

Technical details

The vulnerability exists in the `codec-redis` module, specifically within `RedisEncoder` and several message classes like `InlineCommandRedisMessage`. The `writeString()` method in `RedisEncoder.java` writes user-controlled string content directly to the network buffer without validating or sanitizing Carriage Return Line Feed (CRLF) sequences. Because the Redis Serialization Protocol (RESP) uses CRLF as a delimiter, an attacker can inject arbitrary commands (e.g., FLUSHALL, CONFIG SET) or poison responses. This affects text-based inline commands and simple string/error response types. Patches are available in versions 4.2.13.Final and 4.1.133.Final.

Affected products

• Netty netty-codec-redis >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final

Timeline

• 2026-05-05: advisory: GitHub Advisory published
• 2026-05-07: disclosed: Vulnerability disclosed as CVE-2026-42586

References

• https://api.github.com/users/August829
• https://github.com/August829
• https://api.github.com/users/August829/gists%7B/gist_id%7D
• https://api.github.com/users/August829/repos
• https://avatars.githubusercontent.com/u/11325101?v=4
• https://api.github.com/users/August829/events%7B/privacy%7D