Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe root cause of the vulnerability is the lack of CRLF (\r\n) validation in the Netty codec-redis module when handling specific Redis message types that use simple strings. The Redis protocol (RESP) uses CRLF as a delimiter between commands. An attacker can provide a string containing CRLF characters as input to message types like InlineCommandRedisMessage, SimpleStringRedisMessage, or ErrorRedisMessage.
The constructors for these messages, particularly the parent AbstractStringRedisMessage constructor, fail to validate the input string for these special characters, allowing a malicious payload to be stored within the message object.
Subsequently, when the RedisEncoder's encode method processes these message objects, its internal writeString method writes the malicious string directly to the output stream without sanitization. This results in the injection of additional, attacker-controlled commands or responses into the Redis stream, leading to command injection, data modification, or response poisoning.
The vulnerable functions are therefore the constructors of the affected message classes (InlineCommandRedisMessage, SimpleStringRedisMessage, ErrorRedisMessage, and their parent AbstractStringRedisMessage) which accept the tainted input, and the RedisEncoder.encode method which writes the input to the stream without sanitization.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty:netty-codec-redis | maven | >= 4.2.0.Alpha1, <= 4.2.12.Final | 4.2.13.Final |
| io.netty:netty-codec-redis | maven | <= 4.1.132.Final | 4.1.133.Final |
