CVE-2026-59921

Received Received - Intake

CRLF Injection in Netty via Malicious Filename

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-59921

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.2.16.Final (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability in Netty allows an attacker to inject arbitrary MIME headers into multipart HTTP request bodies by exploiting CRLF characters in filenames. The HttpPostRequestEncoder does not sanitize filenames before embedding them into Content-Disposition headers, enabling header injection attacks.

Detection Guidance

This vulnerability involves CRLF injection in multipart HTTP requests via Netty's HttpPostRequestEncoder. Detection requires inspecting network traffic for malformed HTTP headers or unusual multipart request structures. Use tools like Wireshark or tcpdump to capture and analyze HTTP traffic for CRLF sequences in filenames or headers. Check application logs for errors related to malformed requests or header parsing failures.

Impact Analysis

An attacker could manipulate HTTP requests to bypass security controls, forge headers, or inject malicious content. This may lead to unauthorized actions, data leaks, or server-side request forgery (SSRF) if exploited in vulnerable applications using affected Netty versions.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable Netty versions may face compliance violations and penalties.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or later, or 4.2.16.Final or later, depending on your used version. If upgrading is not immediately possible, implement input validation to sanitize filenames and headers, removing or escaping CRLF characters before processing. Monitor network traffic for signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-59921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70