Netty versions before 4.2.13.Final and 4.1.133.Final allow an attacker to inject carriage‑return line‑feed characters into the Redis encoder's output buffer. Because the Redis Serialization Protocol uses CRLF as a command delimiter, an attacker who can control the content of a Redis message can embed additional Redis commands or fabricate responses. This flaw, identified as a CRLF injection (CWE‑93), can compromise data integrity and cause unintended command execution on the Redis server.

The vulnerability affects applications that use the Netty framework's Redis codec encoder. Specifically, any software built on io.netty:netty-codec-redis or netty:netty prior to 4.2.13.Final (for the 4.2 line) and 4.1.133.Final (for the 4.1 line) is susceptible. Upgrading to these or later releases removes the flaw.

The CVSS score of 6.8 classifies this issue as medium severity, and the EPSS score is not available, suggesting limited publicly known exploitation. The flaw is not listed in the CISA KEV catalog. If an attacker can inject data into the RedisEncoder, they could obtain or modify Redis data by issuing arbitrary commands. The likely attack vector is remote, via network traffic that reaches the encode path, and requires that the attacker controls part of the message content.