CVE-2026-42586

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder RedisEncoder writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF \r\n characters. Since the...

CVE-2026-42586 Netty: CRLF Injection in Netty Redis Codec Encoder

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder RedisEncoder writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF \r\n characters. Since the...

CVE-2026-42586

CVE-2026-42586 affects Netty up to 4.2.13.Final and 4.1.133.Final where the RedisEncoder writes user-controlled strings to the output buffer without sanitizing CRLF (\n). Because RESP uses CRLF as command/response delimiters, an attacker who controls Redis message content can inject arbitrary Red...

Netty 注入漏洞

Netty is a non-blocking I/O client-server framework developed by the Netty community. It is primarily used for developing Java network applications, such as protocol servers and clients. Versions of Netty prior to 4.2.13.Final and 4.1.133.Final contained an injection vulnerability. This...

The vulnerability of the processCommandAndResetClient() function in the Redis database management system allows a hacker to execute arbitrary code.

The vulnerability of the processCommandAndResetClient function in the Redis database management system is related to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the RESTORE command in the Redis database management system allows a hacker to execute arbitrary code.

The vulnerability of the RESTORE command in the Redis database management system is related to buffer overflows in the dynamic memory. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

This Week in Spring - May 12th, 2026

Hi, Spring fans! As I write this I am in Miami, FL at the CodeRemix.ai show, focused on the wide and wonderful world of OpenRewrite and Moderne. I've got a talk to give so let's dive right into it! a quick note about the upcoming release train dates in last week's installment of A Bootiful Podcas...

The vulnerability of Redis’ Lua interpreter, a database management system, allows attackers to execute arbitrary code.

The vulnerability of Redis’ Lua interpreter for database management systems involves the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-42865

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This...

CVE-2026-42865 Inbox Zero: Cross-account cleaner email stream exposure

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This...

CVE-2026-42865 Inbox Zero: Cross-account cleaner email stream exposure

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This...

CVE-2026-42865

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This...

CVE-2026-42865

Inbox Zero is an AI personal assistant for email. Prior to version 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events from one authenticated account to another while using the cleaner feature. This represents a cross-account expo...

EUVD-2026-29169

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This...

CVE-2026-42865 Inbox Zero: Cross-account cleaner email stream exposure

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This...

Inbox Zero 信息泄露漏洞

Inbox Zero is an AI email assistant developed by Elie Steinbock. It automatically organizes the inbox, drafts responses, and manages schedules. Versions of Inbox Zero prior to 2.29.3 had a vulnerability related to information leakage. This vulnerability stemmed from the use of shared Redis...

PT-2026-39715

Name of the Vulnerable Software and Affected Versions Inbox Zero versions prior to 2.29.3 Description The cleaner email stream endpoint used a shared Redis subscription listener. This configuration could result in thread events for one authenticated account being delivered to another authenticate...

Unity Linux 20.1070e Security Update: redis6 (UTSA-2026-017741)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017741 advisory. Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua...

Unity Linux 20.1070e Security Update: redis6 (UTSA-2026-017802)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017802 advisory. Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or...

Unity Linux 20.1060e / 20.1070e Security Update: redis (UTSA-2026-017631)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017631 advisory. Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could b...