Read the docs
TI-2026-42717 Aliases CVE-2026-59903GHSA-8c42-7qj2-3j46

Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Priority LOW 33CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 11 fixed, 19 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Fix Partial netty (netty): 4.1.137.Final, 4.2.17.Finalio.netty:netty-codec-http (Maven): 4.2.17.Final, 4.1.137.FinalRed Hat: 12 advisoriesRed Hat: 11 fixed, 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettybefore 4.1.137.Final; 4.2.0.Final to before 4.2.17.Final4.1.137.Final, 4.2.17.FinalPatch availableCNA
—io.netty:netty-codec-http (Maven)4.2.0.Final to before 4.2.17.Final4.2.17.FinalPatch availableGHSA-8c42-7qj2-3j46
—io.netty:netty-codec-http (Maven)before 4.1.137.Final4.1.137.FinalPatch availableGHSA-8c42-7qj2-3j46
  • netty Vendornetty Affected before 4.1.137.Final; 4.2.0.Final to before 4.2.17.Final Fixed in 4.1.137.Final, 4.2.17.Final Patch available CNA
  • io.netty:netty-codec-http (Maven) Vendor— Affected 4.2.0.Final to before 4.2.17.Final Fixed in 4.2.17.Final Patch available GHSA-8c42-7qj2-3j46
  • io.netty:netty-codec-http (Maven) Vendor— Affected before 4.1.137.Final Fixed in 4.1.137.Final Patch available GHSA-8c42-7qj2-3j46

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.137; 4.2.0 to before 4.2.17Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.137; 4.2.0 to before 4.2.17 Vulnerable ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.1.137.Final, 4.2.17.Final
  • Fix · GHSA-8c42-7qj2-3j46 io.netty:netty-codec-http (Maven) Fixed in 4.2.17.Final Advisory →
  • Fix · GHSA-8c42-7qj2-3j46 io.netty:netty-codec-http (Maven) Fixed in 4.1.137.Final Advisory →

Red Hat 12 advisories

  • RHSA-2026:95887 Released 2026-11-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 security update
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:95762 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.8 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:95760 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.17 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Show 9 more Red Hat advisories
  • RHSA-2026:95761 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.8 Security Update
    • Red Hat build of Keycloak 26.6.8
  • RHSA-2026:95759 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.17 Security Update
    • Red Hat build of Keycloak 26.4.17
  • RHSA-2026:95221 Released 2026-11-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:92056 Released 2026-10-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-apache-cxf-4.1.8-1.redhat_00001.1.el9eap, eap8-apache-cxf-rt-4.1.8-1.redhat_00001.1.el9eap, eap8-apache-cxf-services-4.1.8-1.redhat_00001.1.el9eap +32
  • RHSA-2026:92057 Released 2026-10-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-apache-cxf-4.1.8-1.redhat_00001.1.el8eap, eap8-apache-cxf-rt-4.1.8-1.redhat_00001.1.el8eap, eap8-apache-cxf-services-4.1.8-1.redhat_00001.1.el8eap +33
  • RHSA-2026:92059 Released 2026-10-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 security update
    • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-apache-cxf-4.1.8-1.redhat_00001.1.el10eap, eap8-apache-cxf-rt-4.1.8-1.redhat_00001.1.el10eap, eap8-apache-cxf-services-4.1.8-1.redhat_00001.1.el10eap +32
  • RHSA-2026:63302 Released 2026-09-03 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
    • Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
  • RHSA-2026:62555 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP1 release and security update
    • Red Hat build of Quarkus 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-oidc-3.33.3.redhat-00005.jar +6
  • RHSA-2026:62515 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP1 release and security update
    • Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
Red Hat build of QuarkusAffectedNo fix yet
Red Hat Build of Apache Camel 3.33.3.SP1Fixed RHSA-2026:63302
Red Hat JBoss EAP 8.1 for RHEL 10Fixed RHSA-2026:92059
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:92057
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:92056
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95221
Red Hat build of Keycloak 26.4Fixed RHSA-2026:95760
Red Hat build of Keycloak 26.4.17Fixed RHSA-2026:95759
Red Hat build of Keycloak 26.6Fixed RHSA-2026:95762
Red Hat build of Keycloak 26.6.8Fixed RHSA-2026:95761
Red Hat build of Quarkus 3.27.5.SP1Fixed RHSA-2026:62515
Red Hat build of Quarkus 3.33.3.SP1Fixed RHSA-2026:62555
Not affected: 11 products
  • Red Hat AMQ Broker 7
  • Red Hat Build of Apache Camel 3.33.3.SP1
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss EAP 8.1 for RHEL 10
  • Red Hat JBoss EAP 8.1 for RHEL 8
  • Red Hat JBoss EAP 8.1 for RHEL 9
  • Red Hat Offline Knowledge Portal
  • Red Hat Satellite 6
  • Red Hat build of Quarkus 3.27.5.SP1
  • Red Hat build of Quarkus 3.33.3.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59903
  2. 2026-10-03 Alias added: GHSA-8c42-7qj2-3j46
  3. 2026-10-09 Fix available: RHSA-2026:62555 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:62515 · Red Hat
  5. 2026-10-10 Fix available: Red Hat build of Quarkus 3.27.5.SP1, Red Hat build of Quarkus 3.33.3.SP1 · Red Hat
  6. 2026-10-16 Affected versions changed · Red Hat
  7. 2026-10-18 Affected versions changed · Red Hat
  8. 2026-10-19 Affected versions changed · Red Hat
  9. 2026-10-20 Affected versions changed · Red Hat
  10. 2026-10-21 Affected versions changed · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:63302 · Red Hat
  12. 2026-10-23 Fix available: Red Hat Build of Apache Camel 3.33.3.SP1 · Red Hat
  13. 2026-10-29 Fix available: RHSA-2026:92057 · Red Hat
  14. 2026-10-29 Fix available: RHSA-2026:92059 · Red Hat
  15. 2026-10-29 Fix available: RHSA-2026:92056 · Red Hat
  16. 2026-10-29 Fix available: Red Hat JBoss EAP 8.1 for RHEL 10, Red Hat JBoss EAP 8.1 for RHEL 8, Red Hat JBoss EAP 8.1 for RHEL 9 · Red Hat
  17. 2026-11-04 Fix available: RHSA-2026:95221 · Red Hat
  18. 2026-11-04 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  19. 2026-11-06 Fix available: RHSA-2026:95761 · Red Hat
  20. 2026-11-06 Fix available: Red Hat build of Keycloak 26.6.8 · Red Hat
  21. 2026-11-06 Fix available: RHSA-2026:95760 · Red Hat
  22. 2026-11-06 Fix available: RHSA-2026:95887 · Red Hat
  23. 2026-11-06 Fix available: RHSA-2026:95762 · Red Hat
  24. 2026-11-06 Fix available: RHSA-2026:95759 · Red Hat
  25. 2026-11-06 Fix available: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.17, Red Hat build of Keycloak 26.6 · Red Hat

References

Patch 2

Advisory 1

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences