# CVE-2026-42586: Netty Redis codec CRLF injection in RedisEncoder

Source: https://junglewise.ai/threats/cve-2026-42586-netty-redis-codec-crlf-injection-in-redisencoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-42586 · Severity: medium · CVSS 6.8 · Published 2026-05-13

Netty, a popular networking framework for Java, contains a vulnerability in its Redis protocol component. This flaw allows an attacker to inject unauthorized Redis commands or forge server responses by including special line-break characters in data sent to the application. This could lead to unauthorized data access, modification of database settings, or the deletion of all stored data.

Technologies: [io.netty:netty-codec-redis (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-codec-redis), [Netty Project Codec Redis](https://junglewise.ai/threats/technologies/codec-redis). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-42586 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42586 being exploited in the wild.

**How severe is CVE-2026-42586?** Medium severity, with a CVSS score of 6.8, published 13 May 2026.

**Which products and versions are affected?** io.netty:netty-codec-redis (Maven) ECOSYSTEM:introduced=4.2.0.Alpha1,fixed=4.2.13.Final.

**Is there a fix for CVE-2026-42586?** Yes. io.netty:netty-codec-redis (Maven): upgrade to 4.2.13.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42586 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42586?** Check whether you run io.netty:netty-codec-redis (Maven) or Netty Project Codec Redis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-codec-redis (Maven): upgrade to 4.2.13.Final or later

  ```sh
  # set io.netty:netty-codec-redis to 4.2.13.Final in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in the `codec-redis` module, specifically within `RedisEncoder` and several message classes like `InlineCommandRedisMessage`. The `writeString()` method in `RedisEncoder.java` writes user-controlled string content directly to the network buffer without validating or sanitizing Carriage Return Line Feed (CRLF) sequences. Because the Redis Serialization Protocol (RESP) uses CRLF as a delimiter, an attacker can inject arbitrary commands (e.g., FLUSHALL, CONFIG SET) or poison responses. This affects text-based inline commands and simple string/error response types. Patches are available in versions 4.2.13.Final and 4.1.133.Final.

## Affected products

- Netty netty-codec-redis >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final

## Identifiers

- CVE-2026-42586
- GHSA-rgrr-p7gp-5xj7

## Timeline

- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-07: disclosed: Vulnerability disclosed as CVE-2026-42586

## References

- [https://api.github.com/users/August829](https://api.github.com/users/August829)
- [https://github.com/August829](https://github.com/August829)
- [https://api.github.com/users/August829/gists%7B/gist_id%7D](https://api.github.com/users/August829/gists%7B/gist_id%7D)
- [https://api.github.com/users/August829/repos](https://api.github.com/users/August829/repos)
- [https://avatars.githubusercontent.com/u/11325101?v=4](https://avatars.githubusercontent.com/u/11325101?v=4)
- [https://api.github.com/users/August829/events%7B/privacy%7D](https://api.github.com/users/August829/events%7B/privacy%7D)

## Related threats

- [Netty RedisArrayAggregator memory leak in RESP decoding](https://junglewise.ai/threats/cve-2026-56818-netty-redisarrayaggregator-memory-leak-in-resp-decoding)
- [Netty memory exhaustion in RedisArrayAggregator](https://junglewise.ai/threats/cve-2026-50011-netty-memory-exhaustion-in-redisarrayaggregator)
- [Netty memory exhaustion in RedisArrayAggregator](https://junglewise.ai/threats/cve-2026-48006-netty-memory-exhaustion-in-redisarrayaggregator)
- [Netty memory exhaustion in RedisDecoder](https://junglewise.ai/threats/cve-2026-44890-netty-memory-exhaustion-in-redisdecoder)
- [Netty netty-codec-redis memory exhaustion in RedisArrayAggregator](https://junglewise.ai/threats/cve-2026-44250-netty-netty-codec-redis-memory-exhaustion-in-redisarrayaggregator)