{"id":"CVE-2026-59903","aliases":["CLSA-2026-1793711679","DEBIAN-CVE-2026-59903","EUVD-2026-60318","GHSA-8c42-7qj2-3j46","RHLW-2026-99869c1cad4574fc","SUSE-SU-2026:4391-1","UBUNTU-CVE-2026-59903","openSUSE-SU-2026:11882-1"],"status":"published","title":"Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00324,"percentile":0.2575,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-524"],"published":"2026-08-17T17:56:28Z","modified":"2026-11-12T19:43:13Z","exploits":[{"source":"pocgithub","id":"xiaoqiMikko/netty-http-check","title":"xiaoqiMikko/netty-http-check","date":"2026-09-08","url":"https://github.com/xiaoqiMikko/netty-http-check"}],"fixes":[{"ecosystem":"Maven","package":"io.netty:netty-codec-http","fixed_in":["4.2.17.Final","4.1.137.Final"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"last_affected":"4.2.16.Final"},{"fixed":"4.2.17.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.136.Final"},{"fixed":"4.1.137.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16","1:4.1.48-7","1:4.1.48-7+deb12u1","1:4.1.48-7+deb12u2","1:4.1.48-8","1:4.1.48-9"]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-10+deb13u1","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"fixed":"4.2.17.Final"}]}],"versions":["4.2.0.Final","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.15.Final","4.2.16.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.137.Final"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.11.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.12.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.13.Final","4.1.130.Final","4.1.131.Final","4.1.132.Final","4.1.133.Final","4.1.134.Final","4.1.135.Final","4.1.136.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.138-150200.4.56.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1","1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1","1:4.1.7-4ubuntu0.1+esm1","1:4.1.7-4ubuntu0.1+esm2","1:4.1.7-4ubuntu0.1+esm3","1:4.1.7-4ubuntu0.1+esm4","1:4.1.7-4ubuntu0.1+esm5","1:4.1.7-4ubuntu0.1+esm6","1:4.1.7-4ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.33-1","1:4.1.33-2","1:4.1.33-3","1:4.1.45-1","1:4.1.45-1ubuntu0.1~esm1","1:4.1.45-1ubuntu0.1~esm2","1:4.1.45-1ubuntu0.1~esm3","1:4.1.45-1ubuntu0.1~esm4","1:4.1.45-1ubuntu0.1~esm6","1:4.1.45-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-4","1:4.1.48-4+deb11u1build0.22.04.1","1:4.1.48-4+deb11u2build0.22.04.1","1:4.1.48-4+deb11u2ubuntu0.1~esm1","1:4.1.48-4+deb11u2ubuntu0.1~esm2","1:4.1.48-4+deb11u2ubuntu0.1","1:4.1.48-4+deb11u2ubuntu0.1+esm1","1:4.1.48-4+deb11u2ubuntu0.1+esm3","1:4.1.48-4+deb11u2ubuntu0.2","1:4.1.48-4+deb11u2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-7","1:4.1.48-8","1:4.1.48-9","1:4.1.48-9ubuntu0.1~esm1","1:4.1.48-9ubuntu0.1~esm2","1:4.1.48-9ubuntu0.1","1:4.1.48-9ubuntu0.1+esm1","1:4.1.48-9ubuntu0.1+esm3","1:4.1.48-9ubuntu0.2","1:4.1.48-9ubuntu0.2+esm1","1:4.1.48-9ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-16","1:4.1.48-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-16","1:4.1.48-16ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.138-1.1"}]}],"bundled":30}],"products":[{"vendor":"netty","product":"netty"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/netty/netty/pull/17213","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/netty/netty/pull/17217","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-8c42-7qj2-3j46","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59903.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59903","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29025.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29025","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-5jpm-x58v-624v","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58056.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58056","tags":["advisory"]},{"url":"https://github.com/JLLeitschuh/unCVEed/issues/1","tags":["report"]},{"url":"https://github.com/netty/netty/issues/15522","tags":["report"]},{"url":"https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284","tags":["fix"]},{"url":"https://github.com/netty/netty/pull/15611","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-fghv-69vj-qj49","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67735.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67735","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-84h7-rjj3-6jx4","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33870.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10175","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10184","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13571","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14272","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14276","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17668","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17789","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18054","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18055","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18059","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22619","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7109","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7380","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8159","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33870","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33870.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33870","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pwqr-wmgm-9rr8","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41417.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-v8h7-rr48-vmmv","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41417","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v8h7-rr48-vmmv","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42580.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42580","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m4cv-j2px-7723","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23808","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24502","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25123","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28010","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49700","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49701","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42581","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42581.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42581","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xxqh-mfjm-7mv9","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42584","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42584.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42584","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-57rv-r2g8-2cj3","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42585.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42585","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-38f8-5428-x5cv","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50085","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42587","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42587.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42587","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f6hv-jmp6-3vwv","tags":["advisory"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50020.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50020","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hvcg-qmg6-jm4c","tags":["advisory"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55831.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55831","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","tags":["fix"]},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-6jqx-86gh-f27w","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55833.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55833","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mvh2-crg5-v77c","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56745.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jppx-w49h-x2qq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56746.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56746","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6cqp-g7gg-8hr5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59898.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59898","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59899.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59899","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q4f6-jm68-57ww","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59921.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59921","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gcjf-9mgh-3p7g","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264391-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275500","tags":["report"]},{"url":"https://bugzilla.suse.com/1275501","tags":["report"]},{"url":"https://bugzilla.suse.com/1276420","tags":["report"]},{"url":"https://bugzilla.suse.com/1276421","tags":["report"]},{"url":"https://bugzilla.suse.com/1276455","tags":["report"]},{"url":"https://bugzilla.suse.com/1276456","tags":["report"]},{"url":"https://bugzilla.suse.com/1277243","tags":["report"]},{"url":"https://bugzilla.suse.com/1280048","tags":["report"]},{"url":"https://bugzilla.suse.com/1281431","tags":["report"]},{"url":"https://bugzilla.suse.com/1281432","tags":["report"]},{"url":"https://bugzilla.suse.com/1281433","tags":["report"]},{"url":"https://bugzilla.suse.com/1281434","tags":["report"]},{"url":"https://bugzilla.suse.com/1281435","tags":["report"]},{"url":"https://bugzilla.suse.com/1282084","tags":["report"]},{"url":"https://bugzilla.suse.com/1282085","tags":["report"]},{"url":"https://bugzilla.suse.com/1282132","tags":["report"]},{"url":"https://bugzilla.suse.com/1282140","tags":["report"]},{"url":"https://bugzilla.suse.com/1282141","tags":["report"]},{"url":"https://bugzilla.suse.com/1282362","tags":["report"]},{"url":"https://bugzilla.suse.com/1282363","tags":["report"]},{"url":"https://bugzilla.suse.com/1282364","tags":["report"]},{"url":"https://bugzilla.suse.com/1282366","tags":["report"]},{"url":"https://bugzilla.suse.com/1282367","tags":["report"]},{"url":"https://bugzilla.suse.com/1282370","tags":["report"]},{"url":"https://bugzilla.suse.com/1282372","tags":["report"]},{"url":"https://bugzilla.suse.com/1282373","tags":["report"]},{"url":"https://bugzilla.suse.com/1282374","tags":["report"]},{"url":"https://bugzilla.suse.com/1282378","tags":["report"]},{"url":"https://bugzilla.suse.com/1282506","tags":["report"]},{"url":"https://bugzilla.suse.com/1282507","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93579","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-59903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59903","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59903","title":"Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T17:56:28.726Z","modified":"2026-08-17T18:14:01.121Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-60318","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T17:56:28Z","modified":"2026-08-17T18:14:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:48.395378Z"}],"ghsa":[{"id":"GHSA-8c42-7qj2-3j46","title":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite","description":"### Summary\nNetty's `CorsHandler` silently overwrites existing `Vary` headers, enabling cache poisoning and sensitive information disclosure.\n\n### Details\n`io.netty.handler.codec.http.cors.CorsHandler#setVaryHeader` overwrites any existing Vary headers set by backend applications. \n\n```java\n    private static void setVaryHeader(final HttpResponse response) {\n        response.headers().set(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);\n    }\n```\n\nBecause `set()` replaces all existing values for the header, if a backend application sets a `Vary` header (such as `Vary: Authorization` or `Vary: Cookie`) to ensure that intermediate caches (like CDNs) cache responses separately per user, the `CorsHandler` will overwrite it with `Vary: origin`. This causes the caching proxy to ignore the authorization context and cache the response based solely on the URL and Origin, allowing an attacker to retrieve another user's cached sensitive data.\n\n### Impact\nThis is a Cache Poisoning vulnerability that leads to Information Disclosure. It impacts any Netty-based web application that uses the CorsHandler, sets its own Vary headers to manage caching of authenticated or user-specific responses (e.g., Vary: Authorization), and is deployed behind a caching proxy or CDN. The end-users of these applications are impacted, as their sensitive data may be leaked to unauthorized actors.","status":"published","published":"2026-08-17T18:24:26Z","modified":"2026-08-17T18:24:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T18:17:36.25Z","modified":"2026-09-23T15:21:27.67Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-59903","title":"Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T17:56:28.726Z","modified":"2026-10-28T02:30:21.39953534Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T18:17:36.25Z","modified":"2026-09-24T09:00:19.979915398Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-8c42-7qj2-3j46","title":"Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite","description":"### Summary\nNetty's `CorsHandler` silently overwrites existing `Vary` headers, enabling cache poisoning and sensitive information disclosure.\n\n### Details\n`io.netty.handler.codec.http.cors.CorsHandler#setVaryHeader` overwrites any existing Vary headers set by backend applications. \n\n```java\n    private static void setVaryHeader(final HttpResponse response) {\n        response.headers().set(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);\n    }\n```\n\nBecause `set()` replaces all existing values for the header, if a backend application sets a `Vary` header (such as `Vary: Authorization` or `Vary: Cookie`) to ensure that intermediate caches (like CDNs) cache responses separately per user, the `CorsHandler` will overwrite it with `Vary: origin`. This causes the caching proxy to ignore the authorization context and cache the response based solely on the URL and Origin, allowing an attacker to retrieve another user's cached sensitive data.\n\n### Impact\nThis is a Cache Poisoning vulnerability that leads to Information Disclosure. It impacts any Netty-based web application that uses the CorsHandler, sets its own Vary headers to manage caching of authenticated or user-specific responses (e.g., Vary: Authorization), and is deployed behind a caching proxy or CDN. The end-users of these applications are impacted, as their sensitive data may be leaked to unauthorized actors.","status":"published","published":"2026-08-17T18:24:26Z","modified":"2026-09-10T03:51:13.389261985Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-524"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"RHLW-2026-99869c1cad4574fc","title":"Lightwell Security Advisory: netty-codec-http 4.1.100.Final-rhlw-00001","description":"Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59903, and CVE-2026-59921.\n\nCVE-2024-29025: Netty HttpPostRequestDecoder can OOM\n\nCVE-2025-58056: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions\n\nCVE-2025-67735: Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder\n\nCVE-2026-33870: Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing\n\nCVE-2026-41417: Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()\n\nCVE-2026-42580: Netty: HTTP Request Smuggling due to incorrect chunk size parsing\n\nCVE-2026-42581: Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization\n\nCVE-2026-42584: Netty: HttpClientCodec response desynchronization\n\nCVE-2026-42585: Netty: HTTP Request Smuggling due to malformed Transfer-Encoding\n\nCVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS\n\nCVE-2026-50020: Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted\n\nCVE-2026-55831: Netty SPDY SETTINGS frame count materializes unbounded settings map\n\nCVE-2026-55833: Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation\n\nCVE-2026-56745: Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion\n\nCVE-2026-56746: Netty has a Security Control Bypass via CORS Short-Circuit Failure\n\nCVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation\n\nCVE-2026-59899: Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service\n\nCVE-2026-59903: Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite\n\nCVE-2026-59921: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder\n\nThis patched artifact is a drop-in replacement for io.netty:netty-codec-http 4.1.100.Final from Maven Central.","status":"published","published":"2026-10-12T16:55:52Z","modified":"2026-10-27T04:13:04.170652348Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-59903","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T18:17:00Z","modified":"2026-10-17T12:57:17.681627958Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1793711679","title":"TuxCare security update for io.netty (15 CVEs)","description":"TuxCare rebuilt 7 io.netty packages to address 15 CVEs. Fixed in 4.2.2.Final-tuxcare.2.","status":"published","published":"2026-11-03T14:14:40Z","modified":"2026-11-12T19:43:13.754558159Z","updated_at":"2026-11-12T20:14:41.935484Z"},{"id":"openSUSE-SU-2026:11882-1","title":"netty-4.1.138-1.1 on GA media","description":"These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:09.573141425Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4391-1","title":"Security update for netty, netty-tcnative","description":"This update for netty, netty-tcnative fixes the following issues:\n\n- CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501).\n- CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite\n  (bsc#1275500).\n- CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455).\n- CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456).\n- CVE-2026-75595: fragmented TLS `ClientHello` causes fallback to default `SslContext` and allows for SNI routing and\n  mTLS requirement bypass (bsc#1276420).\n- CVE-2026-75596: fragmented `ClientHello`records can trigger quadratic pre-handshake reassembly in default SNI parsing\n  (bsc#1276421).\n- CVE-2026-76816: missing input validation in `MqttEncoder` allows for null-byte injection, topic hijacking, and ACL\n  bypassing (bsc#1277243).\n- CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding\n  (bsc#1280048).\n- CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084).\n- CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085).\n- CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132).\n- CVE-2026-93493: missing `nextUpdate` field in OCSP responses leads to silent validation bypass (bsc#1281431).\n- CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506).\n- CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service\n  (bsc#1282140).\n- CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141).\n- CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362).\n- CVE-2026-93563: unbounded multi-line response accumulation in `SmtpResponseDecoder` leads to memory exhaustion and a\n  DoS (bsc#1281432).\n- CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363).\n- CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364).\n- CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366).\n- CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled\n  :authority (bsc#1282367).\n- CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370).\n- CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target\n  authority (bsc#1282372).\n- CVE-2026-93572: multiplication of patched preallocation limits in `RedisArrayAggregator` nested RESP headers can lead\n  to denial of service (bsc#1281433).\n- CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373).\n- CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374).\n- CVE-2026-93575: missing validations in the `MqttDecoder` can lead to excessive resource consumption and a DoS\n  (bsc#1281434).\n- CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507).\n- CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass\n  (bsc#1281435).\n- CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378).\n\nChanges for netty:\n\n- Upgrade to upstream version 4.1.138\n\nChanges for netty-tcnative:\n\n- Upgrade to version 2.0.84 Final\n","status":"published","published":"2026-09-29T11:47:41Z","modified":"2026-09-30T12:00:04.604890726Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}