CVE-2026-59903Medium· 6.5▾ TwilightPoC availableNetty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie w…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
1 GitHub repo
Last analysed / modified upstream
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
netty < 4.1.137netty >= 4.2.0, < 4.2.17Upgrade past the affected range:
netty 4.2.17Affected packages:
io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.16.Finalio.netty:netty-codec-http <= 4.1.136.FinalPatched in:
io.netty:netty-codec-http 4.2.17.Finalio.netty:netty-codec-http 4.1.137.FinalSource: https://github.com/advisories/GHSA-8c42-7qj2-3j46
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75595Critical· 9.1Netty is an asynchronous, event-driven network application framework
CVE-2026-59902High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2026-75596High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2026-100663High· 7.5Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers
CVE-2026-100666High· 7.3Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per resp…
CVE-2026-42584High· 7.3Netty is an asynchronous, event-driven network application framework