---
id: CVE-2026-59903
title: 'Netty is an asynchronous, event-driven network application framework'
summary: >-
  Netty is an asynchronous, event-driven network application framework. Prior to
  4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler
  setVaryHeader replaces application Vary headers such as Authorization or
  Cookie w…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-524
  - CWE-444
vendor: netty
product: netty
affected:
  - netty < 4.1.137
  - 'netty >= 4.2.0, < 4.2.17'
patched:
  - netty 4.2.17
published: '2026-08-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T15:21:27.670'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59903'
references:
  - url: 'https://github.com/netty/netty/pull/17213'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/pull/17217'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.1.137.Final'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.2.17.Final'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8c42-7qj2-3j46'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59903.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-59903'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517538'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59903'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59903'
  - url: 'https://access.redhat.com/errata/RHSA-2026:62515'
  - url: 'https://access.redhat.com/errata/RHSA-2026:62555'
tags:
  - nvd
  - exploit-available
  - ghsa
  - maven
  - csaf
  - vex
  - red-hat
epss: 0.00324
epssPercentile: 0.25235
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/xiaoqiMikko/netty-http-check'
  checkedAt: '2026-10-27T19:05:46.010Z'
exploitAvailable: true
aliases:
  - GHSA-8c42-7qj2-3j46
ecosystem: maven
ingestedAt: '2026-08-17T18:59:03.411Z'
---

## Overview

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

## Affected

- `netty < 4.1.137`
- `netty >= 4.2.0, < 4.2.17`

## Remediation

Upgrade past the affected range:

- `netty 4.2.17`

## Package advisory (CVE-2026-59903)

Affected packages:

- `io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.16.Final`
- `io.netty:netty-codec-http <= 4.1.136.Final`

Patched in:

- `io.netty:netty-codec-http 4.2.17.Final`
- `io.netty:netty-codec-http 4.1.137.Final`

Source: https://github.com/advisories/GHSA-8c42-7qj2-3j46

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, OpenShift Serverless, Red Hat AMQ Broker 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, … · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, Exploit Intelligence, OpenShift Serverless, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59903.json)
- **RHSA-2026:62515** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.5.SP1 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:62515)
- **RHSA-2026:62555** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.3.SP1 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:62555)