Is CVE-2026-42586 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42586 being exploited in the wild.

How severe is CVE-2026-42586?

Medium severity, with a CVSS score of 6.8, published 13 May 2026.

Which products and versions are affected?

io.netty:netty-codec-redis (Maven) ECOSYSTEM:introduced=4.2.0.Alpha1,fixed=4.2.13.Final.

Is there a fix for CVE-2026-42586?

Yes. io.netty:netty-codec-redis (Maven): upgrade to 4.2.13.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42586 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42586?

Check whether you run io.netty:netty-codec-redis (Maven) or Netty Project Codec Redis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42586: Netty Redis codec CRLF injection in RedisEncoder

CVE-2026-42586 · Severity: medium · CVSS 6.8 · Published 2026-05-13

Netty, a popular networking framework for Java, contains a vulnerability in its Redis protocol component. This flaw allows an attacker to inject unauthorized Redis commands or forge server responses by including special line-break characters in data sent to the application. This could lead to unauthorized data access, modification of database settings, or the deletion of all stored data.

Technologies: io.netty:netty-codec-redis (Maven), Netty Project Codec Redis. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-42586 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42586 being exploited in the wild.
How severe is CVE-2026-42586?: Medium severity, with a CVSS score of 6.8, published 13 May 2026.
Which products and versions are affected?: io.netty:netty-codec-redis (Maven) ECOSYSTEM:introduced=4.2.0.Alpha1,fixed=4.2.13.Final.
Is there a fix for CVE-2026-42586?: Yes. io.netty:netty-codec-redis (Maven): upgrade to 4.2.13.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42586 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42586?: Check whether you run io.netty:netty-codec-redis (Maven) or Netty Project Codec Redis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.netty:netty-codec-redis (Maven): upgrade to 4.2.13.Final or later

# set io.netty:netty-codec-redis to 4.2.13.Final in your pom.xml or build.gradle

Technical details

The vulnerability exists in the `codec-redis` module, specifically within `RedisEncoder` and several message classes like `InlineCommandRedisMessage`. The `writeString()` method in `RedisEncoder.java` writes user-controlled string content directly to the network buffer without validating or sanitizing Carriage Return Line Feed (CRLF) sequences. Because the Redis Serialization Protocol (RESP) uses CRLF as a delimiter, an attacker can inject arbitrary commands (e.g., FLUSHALL, CONFIG SET) or poison responses. This affects text-based inline commands and simple string/error response types. Patches are available in versions 4.2.13.Final and 4.1.133.Final.

Affected products

Netty netty-codec-redis >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final

Identifiers

CVE-2026-42586
GHSA-rgrr-p7gp-5xj7

Timeline

2026-05-05: advisory: GitHub Advisory published
2026-05-07: disclosed: Vulnerability disclosed as CVE-2026-42586

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.