Netty EUVD-2026-46998

Exploitation requires that: (1) the target application uses Netty's CorsHandler with the shortCircuit() configuration enabled - applications not using CorsHandler are unaffected; (2) the CorsHandler is the primary or sole CORS enforcement mechanism, as additional application-layer authentication would limit impact; and (3) a victim user must be induced to visit an attacker-controlled page that triggers a cross-origin request from a null-origin browser context (UI:R per CVSS). The Origin: null header is automatically produced by browsers from sandboxed iframes, data: URIs, or file:// URLs, so no special browser extension or tool is needed. Limiting factors include the requirement for user interaction (the attacker cannot directly send the null-origin request without victim involvement in a standard browser CSRF model), and the absence of Confidentiality impact - data exfiltration is not a direct consequence of this bypass.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5 (Medium), consistent with a CSRF-style attack profile: network-reachable, low complexity, no attacker privileges required, but requiring user interaction to deliver the null-origin request via a victim browser. The Integrity impact of High reflects that successful bypass allows unauthorized cross-origin write operations against the backend. Confidentiality and Availability are unaffected per the vector. No EPSS data was provided in available intelligence, and the vulnerability is not listed in CISA KEV - active exploitation is unconfirmed. No public POC code is referenced. Real-world risk is notably dependent on deployment context: applications that rely solely on Netty's CorsHandler shortCircuit() as their CORS security boundary are fully exposed, while applications with independent authentication or application-layer CORS enforcement may be unaffected in practice. The breadth of affected versions (spanning both 4.1.x and 4.2.x branches over a wide version range) increases the likelihood that unpatched instances exist in production. This is a medium-urgency remediation - prioritize environments where CorsHandler shortCircuit() is the sole access control on state-changing endpoints.

An attacker hosts a web page containing a sandboxed iframe (e.g., <iframe sandbox='allow-scripts' src='data:...'>), which causes the victim's browser to emit an Origin: null header when making a cross-origin request to the target Netty-backed API. When the victim visits the page, Netty's CorsHandler passes the null-origin request through due to the logical error, and the backend processes the unauthorized request as if CORS controls were satisfied. This enables the attacker to trigger unauthorized write operations on the backend on behalf of the victim without any public exploit code required beyond a crafted HTML page.