CVE-2026-42586: Netty Redis Codec RCE Vulnerability

CVE-2026-42586 Overview

CVE-2026-42586 is a CRLF injection vulnerability [CWE-93] in the Netty asynchronous network application framework. The flaw affects the Redis codec encoder (RedisEncoder) in Netty versions prior to 4.2.13.Final and 4.1.133.Final. The encoder writes user-controlled string content directly to the network output buffer without validating or sanitizing carriage return and line feed (\r\n) characters. Because the Redis Serialization Protocol (RESP) uses CRLF as the command and response delimiter, an attacker who controls the content of a Redis message can inject arbitrary Redis commands or forge responses. Netty maintainers fixed the issue in releases 4.2.13.Final and 4.1.133.Final.

Critical Impact

Attackers controlling Redis message content can inject arbitrary Redis commands or forge fake responses, compromising data integrity in applications using the Netty Redis codec.

Affected Products

• Netty 4.2.x versions prior to 4.2.13.Final
• Netty 4.1.x versions prior to 4.1.133.Final
• Applications using the Netty RedisEncoder to construct Redis Serialization Protocol messages

Discovery Timeline

• 2026-05-13 - CVE-2026-42586 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42586

Vulnerability Analysis

The vulnerability resides in the Netty RedisEncoder class, which serializes Redis Serialization Protocol (RESP) messages onto the wire. RESP uses the CRLF sequence (\r\n) as the structural delimiter between protocol elements such as bulk strings, command arguments, and response framing. The RedisEncoder writes user-supplied string content to the output buffer without filtering or rejecting embedded CRLF byte sequences. An attacker who influences the content of a Redis message can therefore break out of the intended protocol field and append additional RESP elements.

The impact depends on the direction of the affected traffic. On the client side, injected CRLF sequences can append additional commands to a single logical request, smuggling operations through a trusted Redis client. On the server side, an application using RedisEncoder to produce responses can be coerced into emitting forged response framing, misleading the receiving client about command results.

Root Cause

The root cause is missing output neutralization of CRLF metacharacters in a protocol encoder [CWE-93: Improper Neutralization of CRLF Sequences]. The encoder treats application-supplied strings as opaque payloads but writes them into a context where CRLF carries protocol semantics. No length-prefix enforcement or character rejection prevents the embedded delimiters from being interpreted by the peer.

Attack Vector

Exploitation requires that an attacker influence string values passed to the RedisEncoder. Typical attack paths include user-controlled keys, values, or arguments that an application forwards to Redis without first stripping CRLF characters. The attacker crafts input containing \r\n followed by a valid RESP fragment representing an unauthorized command such as FLUSHALL, CONFIG SET, or arbitrary key manipulation. When the encoder serializes the message, the peer parses the injected fragment as a separate, attacker-chosen protocol unit.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-rgrr-p7gp-5xj7 for technical details from the Netty maintainers.

Detection Methods for CVE-2026-42586

Indicators of Compromise

• Redis server logs showing unexpected commands such as FLUSHALL, CONFIG, SCRIPT, or DEBUG originating from application clients that should not issue them.
• Application logs containing user-supplied strings that include raw \r\n byte sequences prior to being passed to Redis client code.
• Network captures of Redis traffic where a single application request frame contains multiple RESP commands separated by CRLF.

Detection Strategies

• Inventory all Java applications using Netty and identify those that depend on io.netty:netty-codec-redis at versions earlier than 4.2.13.Final or 4.1.133.Final.
• Add application-layer logging around Redis client calls to record argument values and flag entries containing CR (0x0D) or LF (0x0A) bytes.
• Deploy network monitoring on Redis ports (default 6379) to alert on RESP frames where a bulk string length declaration does not match the actual byte count consumed before the next CRLF.

Monitoring Recommendations

• Forward Redis MONITOR output or slowlog entries to a centralized logging pipeline and alert on administrative commands issued by non-administrative service accounts.
• Enable software composition analysis in CI/CD to fail builds that pull vulnerable Netty versions transitively.
• Track outbound connections from application servers to Redis instances and baseline command profiles per service.

How to Mitigate CVE-2026-42586

Immediate Actions Required

• Upgrade Netty to 4.2.13.Final or 4.1.133.Final or later, ensuring transitive dependencies are also updated.
• Audit application code paths that pass user-supplied data to the Netty Redis client and reject or strip CRLF characters before encoding.
• Restrict Redis instances to authenticated, network-segmented access so injection cannot pivot to administrative operations.

Patch Information

The Netty maintainers fixed the vulnerability in versions 4.2.13.Final and 4.1.133.Final. Both branches receive parallel maintenance, so applications on the 4.1.x line do not need to migrate to 4.2.x to obtain the fix. Patch details are documented in the Netty Security Advisory GHSA-rgrr-p7gp-5xj7.

Workarounds

• Validate all string inputs passed to RedisEncoder and reject values containing \r (0x0D) or \n (0x0A) bytes.
• Wrap the Redis client API with a sanitization layer that enforces RESP-safe payloads before serialization.
• Apply Redis ACLs to limit the commands available to application service accounts, reducing the blast radius of any injected command.

# Maven dependency update example
# Update pom.xml to use the patched Netty version
# <dependency>
#   <groupId>io.netty</groupId>
#   <artifactId>netty-codec-redis</artifactId>
#   <version>4.1.133.Final</version>
# </dependency>
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.1.133.Final
mvn dependency:tree | grep netty