A AegiFlow
MEDIUMCVSS 6.5EPSS 0.5%

CVE-2026-56746

CVE-2026-56746 updated by NVD

Published
2026-07-22
Modified
2026-07-31
EPSS percentile
38%
Sources
github-advisory, nvd

Summary

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages

EcosystemPackageAffected versionsFixed versions
Mavenio.netty:netty-codec-http4.2.16.Final, 4.1.136.Final

Remediation: Upgrade to 4.2.16.Final or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.