{"id":"CVE-2026-59903","title":"Netty is an asynchronous, event-driven network application framework","summary":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie w…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-524","CWE-444"],"vendor":"netty","product":"netty","affected":["netty < 4.1.137","netty >= 4.2.0, < 4.2.17"],"patched":["netty 4.2.17"],"published":"2026-08-17","updated":"2026-09-23","sourceUpdated":"2026-09-23T15:21:27.670","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","references":[{"url":"https://github.com/netty/netty/pull/17213","label":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/pull/17217","label":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","label":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","label":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-8c42-7qj2-3j46"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59903.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59903"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517538"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59903"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903"},{"url":"https://access.redhat.com/errata/RHSA-2026:62515"},{"url":"https://access.redhat.com/errata/RHSA-2026:62555"}],"tags":["nvd","exploit-available","ghsa","maven","csaf","vex","red-hat"],"epss":0.00324,"epssPercentile":0.25235,"exploits":{"github":1,"githubRepos":["https://github.com/xiaoqiMikko/netty-http-check"],"checkedAt":"2026-10-27T19:05:46.010Z"},"exploitAvailable":true,"aliases":["GHSA-8c42-7qj2-3j46"],"ecosystem":"maven","ingestedAt":"2026-08-17T18:59:03.411Z","slug":"CVE-2026-59903","body":"## Overview\n\nNetty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.\n\n## Affected\n\n- `netty < 4.1.137`\n- `netty >= 4.2.0, < 4.2.17`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `netty 4.2.17`\n\n## Package advisory (CVE-2026-59903)\n\nAffected packages:\n\n- `io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.16.Final`\n- `io.netty:netty-codec-http <= 4.1.136.Final`\n\nPatched in:\n\n- `io.netty:netty-codec-http 4.2.17.Final`\n- `io.netty:netty-codec-http 4.1.137.Final`\n\nSource: https://github.com/advisories/GHSA-8c42-7qj2-3j46\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, … · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Exploit Intelligence, OpenShift Serverless, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59903.json)\n- **RHSA-2026:62515** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.5.SP1 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:62515)\n- **RHSA-2026:62555** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.3.SP1 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:62555)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201846,"id":"CVE-2026-59903","ts":1789399748322,"field":"exploit_available","old":"false","new":"true"},{"seq":200576,"id":"CVE-2026-59903","ts":1789397412975,"field":"exploit_available","old":"true","new":"false"},{"seq":198493,"id":"CVE-2026-59903","ts":1789392002150,"field":"exploit_available","old":"false","new":"true"},{"seq":196286,"id":"CVE-2026-59903","ts":1789383612692,"field":"exploit_available","old":"true","new":"false"},{"seq":195215,"id":"CVE-2026-59903","ts":1789380497749,"field":"exploit_available","old":"false","new":"true"},{"seq":194002,"id":"CVE-2026-59903","ts":1789378553832,"field":"exploit_available","old":"true","new":"false"},{"seq":192789,"id":"CVE-2026-59903","ts":1789376426648,"field":"exploit_available","old":"false","new":"true"},{"seq":191576,"id":"CVE-2026-59903","ts":1789373459116,"field":"exploit_available","old":"true","new":"false"},{"seq":190361,"id":"CVE-2026-59903","ts":1789369359204,"field":"exploit_available","old":"false","new":"true"},{"seq":189148,"id":"CVE-2026-59903","ts":1789368283596,"field":"exploit_available","old":"true","new":"false"},{"seq":187931,"id":"CVE-2026-59903","ts":1789365162597,"field":"exploit_available","old":"false","new":"true"},{"seq":186718,"id":"CVE-2026-59903","ts":1789363308815,"field":"exploit_available","old":"true","new":"false"},{"seq":185504,"id":"CVE-2026-59903","ts":1789361123626,"field":"exploit_available","old":"false","new":"true"},{"seq":184291,"id":"CVE-2026-59903","ts":1789358182160,"field":"exploit_available","old":"true","new":"false"},{"seq":182542,"id":"CVE-2026-59903","ts":1789354239222,"field":"exploit_available","old":"false","new":"true"},{"seq":181335,"id":"CVE-2026-59903","ts":1789353164945,"field":"exploit_available","old":"true","new":"false"},{"seq":180128,"id":"CVE-2026-59903","ts":1789350187956,"field":"exploit_available","old":"false","new":"true"},{"seq":178921,"id":"CVE-2026-59903","ts":1789348123551,"field":"exploit_available","old":"true","new":"false"},{"seq":177714,"id":"CVE-2026-59903","ts":1789346294266,"field":"exploit_available","old":"false","new":"true"},{"seq":176507,"id":"CVE-2026-59903","ts":1789343057713,"field":"exploit_available","old":"true","new":"false"},{"seq":174624,"id":"CVE-2026-59903","ts":1789334801837,"field":"exploit_available","old":"false","new":"true"},{"seq":173419,"id":"CVE-2026-59903","ts":1789333533834,"field":"exploit_available","old":"true","new":"false"},{"seq":172233,"id":"CVE-2026-59903","ts":1789331031245,"field":"exploit_available","old":"false","new":"true"},{"seq":171047,"id":"CVE-2026-59903","ts":1789328647259,"field":"exploit_available","old":"true","new":"false"},{"seq":169842,"id":"CVE-2026-59903","ts":1789327070665,"field":"exploit_available","old":"false","new":"true"},{"seq":168637,"id":"CVE-2026-59903","ts":1789323689617,"field":"exploit_available","old":"true","new":"false"},{"seq":167432,"id":"CVE-2026-59903","ts":1789319601398,"field":"exploit_available","old":"false","new":"true"},{"seq":166227,"id":"CVE-2026-59903","ts":1789318593219,"field":"exploit_available","old":"true","new":"false"},{"seq":165022,"id":"CVE-2026-59903","ts":1789315721784,"field":"exploit_available","old":"false","new":"true"},{"seq":163817,"id":"CVE-2026-59903","ts":1789313482989,"field":"exploit_available","old":"true","new":"false"},{"seq":162612,"id":"CVE-2026-59903","ts":1789311827608,"field":"exploit_available","old":"false","new":"true"},{"seq":161407,"id":"CVE-2026-59903","ts":1789308552694,"field":"exploit_available","old":"true","new":"false"},{"seq":160912,"id":"CVE-2026-59903","ts":1789304509960,"field":"exploit_available","old":"false","new":"true"},{"seq":160459,"id":"CVE-2026-59903","ts":1789304014830,"field":"exploit_available","old":"true","new":"false"},{"seq":159520,"id":"CVE-2026-59903","ts":1789300417920,"field":"exploit_available","old":"false","new":"true"},{"seq":158750,"id":"CVE-2026-59903","ts":1789299522514,"field":"exploit_available","old":"true","new":"false"},{"seq":157714,"id":"CVE-2026-59903","ts":1789296587441,"field":"exploit_available","old":"false","new":"true"},{"seq":156509,"id":"CVE-2026-59903","ts":1789294619213,"field":"exploit_available","old":"true","new":"false"},{"seq":155304,"id":"CVE-2026-59903","ts":1789292822734,"field":"exploit_available","old":"false","new":"true"},{"seq":154099,"id":"CVE-2026-59903","ts":1789289636537,"field":"exploit_available","old":"true","new":"false"},{"seq":152749,"id":"CVE-2026-59903","ts":1789281539743,"field":"exploit_available","old":"false","new":"true"},{"seq":152389,"id":"CVE-2026-59903","ts":1789281144275,"field":"exploit_available","old":"true","new":"false"},{"seq":151350,"id":"CVE-2026-59903","ts":1789277552090,"field":"exploit_available","old":"false","new":"true"},{"seq":150311,"id":"CVE-2026-59903","ts":1789276127922,"field":"exploit_available","old":"true","new":"false"},{"seq":149278,"id":"CVE-2026-59903","ts":1789273760573,"field":"exploit_available","old":"false","new":"true"},{"seq":148245,"id":"CVE-2026-59903","ts":1789271154985,"field":"exploit_available","old":"true","new":"false"},{"seq":146280,"id":"CVE-2026-59903","ts":1789269289452,"field":"exploit_available","old":"false","new":"true"},{"seq":142892,"id":"CVE-2026-59903","ts":1789261390704,"field":"exploit_available","old":"true","new":"false"},{"seq":141723,"id":"CVE-2026-59903","ts":1789258757179,"field":"exploit_available","old":"false","new":"true"},{"seq":140564,"id":"CVE-2026-59903","ts":1789256594815,"field":"exploit_available","old":"true","new":"false"}]}