CVE-2026-59903

Summary

Netty's CorsHandler silently overwrites existing Vary headers, enabling cache poisoning and sensitive information disclosure.

Details

io.netty.handler.codec.http.cors.CorsHandler#setVaryHeader overwrites any existing Vary headers set by backend applications.

    private static void setVaryHeader(final HttpResponse response) {
        response.headers().set(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);
    }

Because set() replaces all existing values for the header, if a backend application sets a Vary header (such as Vary: Authorization or Vary: Cookie) to ensure that intermediate caches (like CDNs) cache responses separately per user, the CorsHandler will overwrite it with Vary: origin. This causes the caching proxy to ignore the authorization context and cache the response based solely on the URL and Origin, allowing an attacker to retrieve another user's cached sensitive data.

Impact

This is a Cache Poisoning vulnerability that leads to Information Disclosure. It impacts any Netty-based web application that uses the CorsHandler, sets its own Vary headers to manage caching of authenticated or user-specific responses (e.g., Vary: Authorization), and is deployed behind a caching proxy or CDN. The end-users of these applications are impacted, as their sensitive data may be leaked to unauthorized actors.

Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, and CVE-2026-59921.

CVE-2024-29025: Netty HttpPostRequestDecoder can OOM

CVE-2025-58056: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

CVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

CVE-2026-33870: Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

CVE-2026-41417: Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

CVE-2026-42580: Netty: HTTP Request Smuggling due to incorrect chunk size parsing

CVE-2026-42581: Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

CVE-2026-42584: Netty: HttpClientCodec response desynchronization

CVE-2026-42585: Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

CVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

CVE-2026-50020: Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

CVE-2026-55831: Netty SPDY SETTINGS frame count materializes unbounded settings map

CVE-2026-55833: Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

CVE-2026-56745: Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

CVE-2026-56746: Netty has a Security Control Bypass via CORS Short-Circuit Failure

CVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

CVE-2026-59899: Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

CVE-2026-59903: Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

CVE-2026-59921: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

This patched artifact is a drop-in replacement for io.netty:netty-codec-http 4.1.100.Final from Maven Central.

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

TuxCare rebuilt 7 io.netty packages to address 15 CVEs. Fixed in 4.2.2.Final-tuxcare.2.

These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues:

• CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501).
• CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite (bsc#1275500).
• CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455).
• CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456).
• CVE-2026-75595: fragmented TLS ClientHello causes fallback to default SslContext and allows for SNI routing and mTLS requirement bypass (bsc#1276420).
• CVE-2026-75596: fragmented ClientHellorecords can trigger quadratic pre-handshake reassembly in default SNI parsing (bsc#1276421).
• CVE-2026-76816: missing input validation in MqttEncoder allows for null-byte injection, topic hijacking, and ACL bypassing (bsc#1277243).
• CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding (bsc#1280048).
• CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084).
• CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085).
• CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132).
• CVE-2026-93493: missing nextUpdate field in OCSP responses leads to silent validation bypass (bsc#1281431).
• CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506).
• CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (bsc#1282140).
• CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141).
• CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362).
• CVE-2026-93563: unbounded multi-line response accumulation in SmtpResponseDecoder leads to memory exhaustion and a DoS (bsc#1281432).
• CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363).
• CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364).
• CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366).
• CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (bsc#1282367).
• CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370).
• CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (bsc#1282372).
• CVE-2026-93572: multiplication of patched preallocation limits in RedisArrayAggregator nested RESP headers can lead to denial of service (bsc#1281433).
• CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373).
• CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374).
• CVE-2026-93575: missing validations in the MqttDecoder can lead to excessive resource consumption and a DoS (bsc#1281434).
• CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507).
• CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass (bsc#1281435).
• CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378).

Changes for netty:

• Upgrade to upstream version 4.1.138

Changes for netty-tcnative:

• Upgrade to version 2.0.84 Final