Netty’s SOCKS4 and SOCKS5 client encoders do not properly validate domain addresses and authentication fields, permitting an attacker who can influence these fields to inject null bytes or CRLF characters. This can truncate or alter values, leading to domain spoofing, userid truncation, authentication data injection, and protocol confusion. The flaw is classified as CWE‑626 and CWE‑93 and can compromise the integrity of SOCKS traffic and potentially allow denial of service or manipulation of authenticated connections.

The affected packages are the netty‑codec‑socks modules of the Netty framework. Versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final are susceptible. The vulnerability applies to both the Socks4ClientEncoder and Socks5ClientEncoder components. Users of earlier or later releases are not impacted.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is low, at 0.00253 (less than 1%), and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation is publicly documented. The likely attack vector is remote, requiring an attacker to inject crafted proxy requests that control the domain or authentication fields. If the targeted environment allows untrusted SOCKS clients, the risk elevates; otherwise, the exposure is limited to internal, trusted traffic.