What’s Vulnerable › Vulnerabilities

CVE-2026-59903: Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-17 · updated 2026-09-23
• Weakness: CWE-524

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Affected products

• netty: before 4.1.137; from 4.2.0 before 4.2.17 — fixed in 4.1.137, 4.2.17

How to fix

Upgrade to a fixed version: netty 4.1.137, 4.2.17. Check the vendor advisory for mitigations.

References

• https://github.com/netty/netty/pull/17213
• https://github.com/netty/netty/pull/17217
• https://github.com/netty/netty/releases/tag/netty-4.1.137.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.17.Final
• https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46

Get alerted when CVE-2026-59903 or the next vulnerability affects your stack