CVE-2026-56746High· 7.5▾ TwilightA flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access r…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
7.5 → 6.5
high → medium
6.5 → 7.5
medium → high
7.5 → 6.5
high → medium
6.5 → 7.5
medium → high
7.5 → 6.5
high → medium
6.5 → 7.5
medium → high
0.4% → 0.4%
Last analysed / modified upstream
A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.
io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header — rated Important by Red Hat. Released 2026-07-21, updated 2026-10-20.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:70230 Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:70228 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333
Workarounds / mitigations:
Affected packages:
io.netty:netty-codec-http >= 4.2.0.Final, < 4.2.16.Finalio.netty:netty-codec-http < 4.1.136.FinalPatched in:
io.netty:netty-codec-http 4.2.16.Finalio.netty:netty-codec-http 4.1.136.FinalField changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55831High· 7.5io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)
CVE-2026-55833High· 7.5netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)
CVE-2026-56745High· 7.5netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745)
CVE-2026-59899High· 7.5io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899)
CVE-2026-54512High· 8.1jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
CVE-2026-54513High· 8.1jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)