Bug 2477213 (CVE-2026-42586)

Summary:	CVE-2026-42586 netty-codec-redis: Netty: Command injection via CRLF characters in Redis codec encoder
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dhanak, dlofthou, drichtar, drosa, fmariani, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jrokos, jwon, mcarlett, mnovotny, mosmerov, mposolda, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rmartinc, rstancel, rstepani, sausingh, smaestri, ssilvert, sthorger, tcunning, thjenkin, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Netty, an asynchronous, event-driven network application framework. The Netty Redis codec encoder (RedisEncoder) does not properly validate or sanitize user-controlled string content for CRLF (Carriage Return Line Feed) characters. A remote attacker, by controlling the content of a Redis message, can inject arbitrary Redis commands or forge fake responses. This can lead to a high impact on data integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-13 19:01:29 UTC

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Comment 3 errata-xmlrpc 2026-07-09 15:30:57 UTC

This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Via RHSA-2026:37390 https://access.redhat.com/errata/RHSA-2026:37390

Comment 4 errata-xmlrpc 2026-07-20 11:59:45 UTC

This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.2

Via RHSA-2026:41951 https://access.redhat.com/errata/RHSA-2026:41951