The flaw occurs when Netty’s CorsHandler replaces application‑level Vary headers such as Authorization or Cookie with Origin, causing a caching proxy or CDN to serve authenticated responses to other users. The primary impact is the disclosure of sensitive data across account boundaries. This is an information disclosure weakness (CWE‑524) and does not allow direct code execution. The problem is triggered by standard HTTP requests that are handled by the affected CorsHandler implementation. Based on the description, it is inferred that the attack vector is external HTTP traffic.

The vendor is Netty and the affected product is the io.netty.handler.codec.http.cors.CorsHandler component used in Netty HTTP servers and clients. Versions prior to 4.1.137.Final and 4.2.17.Final are vulnerable. Applications that embed Netty 4.1.x or 4.2.x before these patched releases are affected.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Exploitation requires that a caching layer respect the Origin header and not consider the original Authorization header, which is a common setup for CDNs and reverse proxies. An attacker can force the server to cache a sensitive response and later retrieve it via a different user’s request, leading to cross‑user data leakage. The attack vector is external HTTP traffic and does not require privileged local access.