Redis Command Injection in Netty Framework
CVE-2026-42586

6.8MEDIUM

Key Information:

Vendor

Netty

Status
Netty
Netty-codec-redis
Vendor
CVE Published:
13 May 2026

What is CVE-2026-42586?

The Netty framework, a widely used asynchronous network application framework, has a vulnerability that allows an attacker to exploit unvalidated user-controlled string content. Specifically, the RedisEncoder component in versions prior to 4.2.13.Final and 4.1.133.Final improperly handles CRLF characters. This oversight enables an attacker to inject malicious Redis commands or generate forged responses under certain conditions. Users are urged to upgrade to the fixed versions to mitigate this risk.

Affected Version(s)

netty >= 4.2.0.Alpha1, < 4.2.13.Final < 4.2.0.Alpha1, 4.2.13.Final

netty < 4.1.133.Final < 4.1.133.Final

netty-codec-redis >= 4.2.0.Alpha1, < 4.2.13.Final < 4.2.0.Alpha1, 4.2.13.Final

References

https://github.com/netty/netty/security/advisories/GHSA-r...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.