CVEvulnerability

CVE-2026-42586

7.1 HIGH Published 2026-05-13 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-05-13
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-93

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected configurations

• netty netty (< 4.1.133) • netty netty (>= 4.2.0 < 4.2.13)

Related

Weakness · CWE (1)

  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References