Skip to main content

Netty CVE-2026-59903

| EUVDEUVD-2026-60318 HIGH
Use of Cache Containing Sensitive Information (CWE-524)
2026-08-17 GitHub_M GHSA-8c42-7qj2-3j46
Information Disclosure Netty
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Netty+CorsHandler app behind shared CDN
  2. Delivery
    Backend sets Vary: Authorization, CorsHandler rewrites to Vary: Origin
  3. Exploit
    Victim's authenticated response cached keyed only on URL+Origin
  4. Execution
    Attacker requests same URL with matching Origin
  5. Impact
    CDN serves victim's cached sensitive data

Vulnerability Assessment

Weakness
CWE
CWE-524
ASVS 5.0
V3 - Web Frontend Security Cache-Control for sensitive pages
Exploitation Conditions

Exploitation requires a specific compound configuration, not default deployment: the target must (1) be a Netty-based web application that installs io.netty.handler.codec.http.cors.CorsHandler, (2) have its backend set its own Vary headers such as Vary: Authorization or Vary: Cookie to segment per-user caching of authenticated responses, and (3) sit behind a shared caching proxy or CDN that honors Vary. If any of these is absent - no CorsHandler, no application-set Vary headers, or no intermediate shared cache - the flaw is not exploitable. When all conditions hold, no authentication or user interaction is needed (PR:N/UI:N) to retrieve another user's cached data. Affected versions: netty-codec-http <= 4.1.136.Final and 4.2.0.Final through 4.2.16.Final; fixed in 4.1.137.Final and 4.2.17.Final.
Impact

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) frames this as a high-severity, unauthenticated, network-exploitable confidentiality flaw, but every corroborating signal points to much lower real-world urgency. EPSS is 0.40% (33rd percentile) and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - CISA does not consider this automatable or actively exploited. It is NOT in KEV. A POC gist is publicly linked (cve-search), so publicly available exploit code exists, but this must not be conflated with active exploitation. Most importantly, the vulnerability is heavily gated: it only manifests when a Netty application uses CorsHandler AND the backend sets its own Vary headers (e.g. Vary: Authorization/Cookie) for per-user caching AND is deployed behind a shared caching proxy/CDN. Netty's own PR:N/AC:L rating understates this - the attacker does not control these deployment preconditions, so the SSVC 'partial technical impact' and low EPSS are the more honest indicators. This is a real, correctly-classified information-disclosure bug worth patching in the next maintenance cycle, but it is a high-CVSS-but-conditionally-exploitable issue rather than an emergency.
Exploit ScenarioDerived

A Netty-based application uses CorsHandler and sets Vary: Authorization so a CDN caches authenticated responses separately per user; CorsHandler silently overwrites this with Vary: Origin, so the CDN keys the cache only on URL and Origin. An attacker (or any unauthenticated user) then requests the same URL with a matching Origin and receives another user's cached authenticated response, disclosing sensitive data. Publicly available POC/exploit code is referenced in the advisory data (gist), lowering the barrier to reproduction.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 23, 2026

Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final and 4.2.17.Final, letting a shared caching proxy or CDN reuse authenticated, user-specific responses across users and leak sensitive data. Exposure is confined to deployments that install io.netty.handler.codec.http.cors.CorsHandler, also set their own Vary headers (such as Authorization or Cookie) for per-user caching, and sit behind a shared cache; because those three conditions must coincide, the assessed vector raises attack complexity to AC:H even though the published base score is 7.5 (AV:N/PR:N/UI:N/C:H). Publicly available exploit code exists (a public gist alongside the upstream fix PRs), but there is no evidence of active exploitation: the issue is not in CISA KEV, SSVC records Exploitation: none and Automatable: no, and EPSS is only 0.40% (33rd percentile), consistent with the assessment that real-world urgency is much lower than the headline score suggests.

Earlier versions of this analysis (1)
v1 Aug 17, 2026 - 18:41 CVSS 6.5

Netty's CorsHandler silently overwrites any application-set Vary headers with only 'Vary: Origin', enabling caching proxies and CDNs to conflate and serve authenticated, user-specific HTTP responses to unauthorized requesters. Affected are all Netty deployments running netty-codec-http prior to 4.1.137.Final or 4.2.17.Final where applications set per-user Vary headers (e.g., Vary: Authorization or Vary: Cookie) and are deployed behind a caching layer. No public exploit identified at time of analysis; vendor-released patches are confirmed available in 4.1.137.Final and 4.2.17.Final.

RemediationAI

Apply the vendor-released patch by upgrading to 4.1.137.Final on the 4.1.x branch or 4.2.17.Final on the 4.2.x branch, as documented in the advisory https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46 and delivered through https://github.com/netty/netty/pull/17213 and https://github.com/netty/netty/pull/17217 (release tags netty-4.1.137.Final and netty-4.2.17.Final). If the upgrade cannot be shipped immediately, the most direct compensating control is to remove CorsHandler from the Netty pipeline and terminate CORS at an outer layer such as a reverse proxy, API gateway, or servlet filter that merges Vary values instead of overwriting them; the trade-off is that origin echoing and preflight handling must be reimplemented and retested. A second option is to strip or re-append the Vary header at the cache boundary after Netty has written the response so that Vary: Authorization or Vary: Cookie reaches the CDN intact, at the cost of an extra component that must stay in sync with application behavior. A third is to mark authenticated responses non-cacheable (Cache-Control: private, no-store) at the application or edge so the shared cache never stores per-user content, sacrificing edge caching for those endpoints. Because the public gist exploit code exists but SSVC records Exploitation: none and EPSS is only 0.40% (33rd percentile), patching can follow normal release cycles while inventory is checked for the compound prerequisite of CorsHandler plus application-set Vary headers plus a shared caching proxy or CDN.

Affected VersionsENISA

netty 4.2.0.Final, < 4.2.17.Final
netty < 4.1.137.Final

Affected Packages

maven io.netty:netty-codec-http fix: 4.1.137.Final, 4.2.17.Final
euvd netty fix: 4.1.137.Final
euvd netty_4_2_0_final fix: 4.2.17.Final

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-524 (Use of Cache Containing Sensitive Information) is realized here in Netty's HTTP codec: io.netty.handler.codec.http.cors.CorsHandler#setVaryHeader calls response.headers().set(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN), and Netty's set() replaces every existing value of that header. Any backend-supplied Vary: Authorization or Vary: Cookie - the standard mechanism telling intermediate caches to key responses per user - is therefore destroyed before the response leaves the framework, collapsing the cache key down to URL plus Origin, which is a cache-poisoning primitive for shared CDNs and reverse proxies. The upstream fix in PRs 17213 and 17217 changes set() to add() guarded by containsValue(VARY, ORIGIN, true), so Origin is appended rather than substituted, and a regression test (varyHeaderIsAppended) asserts that both Accept-Encoding and Origin survive. The vulnerable artifact is the Maven package io.netty:netty-codec-http, also represented by the aggregate CPE cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*; the handler is the CORS implementation commonly wired into Netty-based HTTP server pipelines, and the flaw only manifests when a downstream shared cache that honors Vary is present.

Know when Netty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY MEDIUM
NVD 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 5.9 MEDIUM

Unauthenticated network disclosure (PR:N/AV:N) but AC:H because success depends on specific app Vary usage plus a shared cache the attacker does not control; confidentiality-only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Red Hat 6.5 MEDIUM

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Severity Changed
Sep 23, 2026 - 15:22 NVD
MEDIUM HIGH
CVSS changed
Sep 23, 2026 - 15:22 NVD
6.5 (MEDIUM) 7.5 (HIGH)
Patch available
Aug 17, 2026 - 19:18 EUVD
CVE Published
Aug 17, 2026 - 17:56 cve.org
MEDIUM 6.5

DescriptionNVD

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 344 maven packages depend on io.netty:netty-codec-http (32 direct, 312 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

Executive ViewAI

Why It Matters

A flaw in Netty, the networking library embedded in a large share of Java-based services and APIs, can cause shared caches and CDNs to hand one authenticated user's response to a different user, exposing session tokens, account details, and other personal data. Only deployments that use Netty's CORS handler while setting their own per-user Vary headers behind a shared cache are exposed, but those that are face a cross-customer data disclosure carrying privacy and regulatory consequences. Publicly available exploit code exists, yet there is no evidence of active exploitation (not in CISA KEV, SSVC Exploitation: none, EPSS 0.40%), giving owners of affected internet-facing services a short window to remediate deliberately rather than under incident pressure.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.4%
Top 67% exploitable
Prevalence
High
Netty is an extremely widely deployed Java networking framework underpinning many stacks
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot

Same weakness CWE-524 – Use of Cache Containing Sensitive Information

View all
CVE-2024-45596 MEDIUM POC
6.5
CVE-2025-69202 MEDIUM POC
6.0
CVE-2026-53943 CRITICAL
9.6
CVE-2025-69581 MEDIUM POC
5.5
CVE-2026-19202 CRITICAL
9.1
CVE-2026-93748 HIGH
8.7
CVE-2026-61836 HIGH
8.6
CVE-2022-3292 MEDIUM POC
4.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/391380 REF https://github.com/netty/netty/pull/17213 REF https://github.com/netty/netty/pull/17217 REF https://github.com/netty/netty/releases/tag/netty-4.1.137.Final REF https://github.com/netty/netty/releases/tag/netty-4.2.17.Final REF https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy