Read the docs
TI-2026-30866 Aliases CVE-2026-42586GHSA-rgrr-p7gp-5xj7

Netty: CRLF Injection in Netty Redis Codec Encoder

Priority LOW 31CWE-93Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial netty (netty): 4.2.13.Final, 4.1.133.Finalnetty-codec-redis (io.netty): 4.2.13.Final, 4.1.133.Final+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final4.2.13.Final, 4.1.133.FinalPatch availableCNA
nettynetty-codec-redis4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final4.2.13.Final, 4.1.133.FinalPatch availableCNA
—io.netty:netty-codec-redis (Maven)4.2.0.Alpha1 to before 4.2.13.Final4.2.13.FinalPatch availableGHSA-rgrr-p7gp-5xj7
—io.netty:netty-codec-redis (Maven)before 4.1.133.Final4.1.133.FinalPatch availableGHSA-rgrr-p7gp-5xj7
  • netty Vendornetty Affected 4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final Fixed in 4.2.13.Final, 4.1.133.Final Patch available CNA
  • netty-codec-redis Vendornetty Affected 4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final Fixed in 4.2.13.Final, 4.1.133.Final Patch available CNA
  • io.netty:netty-codec-redis (Maven) Vendor— Affected 4.2.0.Alpha1 to before 4.2.13.Final Fixed in 4.2.13.Final Patch available GHSA-rgrr-p7gp-5xj7
  • io.netty:netty-codec-redis (Maven) Vendor— Affected before 4.1.133.Final Fixed in 4.1.133.Final Patch available GHSA-rgrr-p7gp-5xj7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.133; 4.2.0 to before 4.2.13Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.133; 4.2.0 to before 4.2.13 Vulnerable ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.2.13.Final, 4.1.133.Final
  • Fix · CNA netty-codec-redis (io.netty) Fixed in 4.2.13.Final, 4.1.133.Final
  • Fix · GHSA-rgrr-p7gp-5xj7 io.netty:netty-codec-redis (Maven) Fixed in 4.2.13.Final Advisory →
  • Fix · GHSA-rgrr-p7gp-5xj7 io.netty:netty-codec-redis (Maven) Fixed in 4.1.133.Final Advisory →

Red Hat 2 advisories

  • RHSA-2026:41951 Released 2026-07-20 · Red Hat rating Important
    Red Hat Data Grid 8.6.2 security update
    • Red Hat Data Grid 8.6.2
  • RHSA-2026:37390 Released 2026-07-09 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.1.P1 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Data Grid 8.6.2Fixed RHSA-2026:41951
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16Fixed RHSA-2026:37390
Not affected: 2 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42586
  2. 2026-10-03 Alias added: GHSA-rgrr-p7gp-5xj7

References

Exploit 1

Advisory 1

Other 4

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences