6.8
Medium
CVE-2026-42586 Netty is an asynchronous, event-driven network application framework
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| netty 4.2 | 4.2.0.Alpha1 → < 4.2.13.Final | 4.2.13.Final |
| netty 4.1 | earliest → < 4.1.133.Final | 4.1.133.Final |
| netty-codec-redis 4.2 | 4.2.0.Alpha1 → < 4.2.13.Final | 4.2.13.Final |
| netty-codec-redis 4.1 | earliest → < 4.1.133.Final | 4.1.133.Final |
Other CVEs of netty
The 95 CVEs of netty →
CVE-2026-100666
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to…
6.9
Medium
CVE-2026-100665
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC…
8.7
High
CVE-2026-100664
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority…
8.7
High
CVE-2026-100663
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1…
8.7
High