Skip to main content

Netty netty-codec-socks EUVDEUVD-2026-64272

| CVE-2026-62380 MEDIUM
Null Byte Interaction Error (Poison Null Byte) (CWE-626)
2026-08-22 VulnCheck GHSA-jmpc-xv4r-m7fw
Code Injection Red Hat Suse Netty
6.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.0 MEDIUM

AC:H reflects the prerequisite of attacker-controlled input reaching the encoder; S:C because injection affects downstream SOCKS proxy routing beyond the Netty host.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 22, 2026 - 13:16 EUVD
Analysis Generated
Aug 22, 2026 - 13:06 vuln.today
CVE Published
Aug 22, 2026 - 12:26 cve.org
MEDIUM 6.3

DescriptionCVE.org

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.

AnalysisAI

Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that attacker-controlled data reaches the domain address field (Socks4ClientEncoder or Socks5ClientEncoder) or the authentication username/password fields (Socks5ClientEncoder) of the Netty SOCKS client. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.3 reflects a moderate real-world risk profile: the AT:P attribute (attack requirements present) captures the critical limiting factor - exploitation depends on the attacker's ability to inject controlled values into the SOCKS domain or authentication fields of an application using Netty as a SOCKS client. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Netty 4.2.17.Final (for the 4.2.x branch) or 4.1.137.Final (for the 4.1.x branch), which introduce input validation in both Socks4ClientEncoder and Socks5ClientEncoder to reject or sanitize null bytes and CRLF sequences. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
CVE-2022-41881 HIGH POC
7.5 Dec 12

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner

Same weakness CWE-626 – Null Byte Interaction Error (Poison Null Byte)

View all
CVE-2026-42010 CRITICAL
9.8
CVE-2019-11936 CRITICAL
9.8
CVE-2020-10773 MEDIUM
4.4

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

EUVD-2026-64272 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy