Description
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Netty’s CorsHandler may short‑circuit unauthorized cross‑origin requests, but a logic error exposes a path that allows requests with an Origin: null header to bypass that protection. The bypass results in the backend application receiving requests that should have been rejected, effectively disabling the intended access controls. This is an Access Control Bypass (CWE‑284).

Affected Systems

Netty library versions 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final are vulnerable. The issue was addressed in Netty 4.1.136.Final and 4.2.16.Final.

Risk and Exploitability

The CVSS score for this vulnerability is 6.5, indicating moderate severity, while the EPSS score is less than 1 percent, suggesting a low likelihood of exploitation in the wild. It is not currently listed in CISA’s KEV catalog. An attacker can exploit the flaw by sending an HTTP request that includes an Origin: null header, causing the request to bypass the short‑circuit check and reach the application backend. If the application relies solely on the short‑circuit for cross‑origin protection, the bypass can lead to unauthorized access to protected resources.

Generated by OpenCVE AI on August 2, 2026 at 21:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Netty to 4.1.136.Final or later, or 4.2.16.Final or later so that the logic flaw is removed.
  • Verify that CorsHandler is configured with shortCircuit enabled in the fixed version; if CORS is not required, consider disabling the handler entirely.
  • As a temporary measure, block requests with Origin: null at the application entry point or on the network ingress layer until the library is updated.

Generated by OpenCVE AI on August 2, 2026 at 21:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-6cqp-g7gg-8hr5 Netty: Security Control Bypass via CORS Short-Circuit Failure
History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-807
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 22 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
First Time appeared Netty
Netty netty
Vendors & Products Netty
Netty netty

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Title Netty has a Security Control Bypass via CORS Short-Circuit Failure
Weaknesses CWE-284
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Subscriptions

Netty Netty
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-22T13:39:41.978Z

Reserved: 2026-06-22T19:17:28.959Z

Link: CVE-2026-56746

cve-icon Vulnrichment

Updated: 2026-07-22T13:39:38.493Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-21T21:36:18Z

Links: CVE-2026-56746 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T21:30:04Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision