CVE-2026-56746

Received Received - Intake

Origin Header Bypass in Netty Framework

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-56746

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	From 4.1.0.Final (inc) to 4.1.135.Final (inc)
netty	netty	From 4.2.0.Final (inc) to 4.2.15.Final (inc)
netty	netty	4.1.136.Final
netty	netty	4.2.16.Final

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in Netty, a network application framework. It allows bypassing a security control called CorsHandler that is meant to block unauthorized cross-origin requests. Due to a logical error, an attacker can send a request with an Origin: null header to bypass this protection and send unauthorized requests to the backend application.

Detection Guidance

To detect this vulnerability, check if your Netty version is between 4.2.0.Final and 4.2.15.Final or 4.1.0.Final and 4.1.135.Final. Use commands like 'find / -name netty-*.jar' to locate Netty JAR files and inspect their versions. If vulnerable versions are found, update to 4.1.136.Final or 4.2.16.Final or later.

Impact Analysis

An attacker could exploit this to send unauthorized requests to your application, potentially accessing sensitive data or performing actions they shouldn't be able to. This could lead to data breaches or unauthorized access to protected resources.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, and other regulations. It may result in legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Immediately update Netty to version 4.1.136.Final or 4.2.16.Final or later. If updating is not possible, disable the CorsHandler shortCircuit() configuration or implement additional origin validation checks in your application to block requests with 'Origin: null' headers.

Hi! I’m here to help you understand CVE-2026-56746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70