Skip to main content

Netty CVE-2026-56746

| EUVDEUVD-2026-46998 MEDIUM
Improper Access Control (CWE-284)
2026-07-21 security-advisories@github.com GHSA-6cqp-g7gg-8hr5
Authentication Bypass Netty Red Hat
6.5
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today AI
6.5 MEDIUM

Network-exploitable via victim browser (AV:N, UI:R); no privileges required; integrity-only impact as CORS bypass enables unauthorized writes with no data disclosure or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

4
Source Code Evidence Fetched
Jul 22, 2026 - 09:26 vuln.today
Analysis Generated
Jul 22, 2026 - 09:26 vuln.today
Patch available
Jul 21, 2026 - 23:36 EUVD
CVE Published
Jul 21, 2026 - 22:17 cve.org
MEDIUM 6.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 344 maven packages depend on io.netty:netty-codec-http (32 direct, 312 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

AnalysisAI

Cross-origin resource sharing controls in Netty's CorsHandler can be entirely bypassed by sending an Origin: null header, due to a logical operator error in the origin evaluation path. Affected are Netty 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final - a range spanning years of releases across both major active branches. An unauthenticated remote attacker who can induce a victim to initiate a cross-origin request can bypass the shortCircuit() enforcement entirely, causing unauthorized requests to be forwarded to the backend application as if they were permitted. No public exploit or KEV listing is identified at time of analysis, but the bypass mechanism is straightforward and vendor-confirmed.

Technical ContextAI

Netty is a Java NIO client-server networking framework underpinning gRPC, Vert.x, Micronaut, and a large portion of the Java microservices ecosystem. Its CorsHandler class implements CORS policy enforcement, including a shortCircuit() mode that is designed to short-circuit the pipeline and immediately reject requests from unauthorized origins before they reach application logic - functioning as a security gate, not merely a response header mechanism. The root cause is CWE-284 (Improper Access Control): a logical operator error in the origin comparison routine fails to correctly classify the special Origin: null value. Browsers legitimately emit Origin: null for requests from sandboxed iframes, data: URIs, and file:// contexts; the flawed logic treats this value as passing the origin check rather than failing it, forwarding the request downstream. Affected CPE covers io.netty artifacts across the 4.1.x and 4.2.x lines as confirmed by EUVD-2026-46998.

RemediationAI

Upgrade to Netty 4.1.136.Final or 4.2.16.Final, which contain the fix for the logical operator error in origin evaluation. Release artifacts are available on GitHub at https://github.com/netty/netty/releases/tag/netty-4.1.136.Final and https://github.com/netty/netty/releases/tag/netty-4.2.16.Final, and via Maven Central for io.netty dependencies. If immediate upgrade is blocked, a compensating control is to add an upstream reverse proxy rule (e.g., nginx if ($http_origin = 'null') { return 403; }) to reject requests with a literal Origin: null header before they reach Netty - note this may block legitimate sandboxed iframe traffic as a side effect. A second compensating control is to implement independent authentication on all state-changing backend endpoints so that CORS bypass alone does not enable unauthorized modification. Do not rely solely on removing the shortCircuit() call as mitigation, as that simply disables CORS enforcement entirely.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
CVE-2022-41881 HIGH POC
7.5 Dec 12

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
CVE-2020-7238 HIGH POC
7.5 Jan 27

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

CVE-2026-56746 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy