CVE-2026-59903
Received Received - Intake

CORS Header Manipulation in Netty Framework

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-59903
EUVD
EUVD-2026-60318

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
netty netty to 4.2.17_final (exc)
netty netty to 4.1.137_final (exc)
netty netty 4.1.137_final
netty netty 4.2.17_final
netty netty to 4.1.137.final (exc)
netty netty to 4.2.17.final (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-524 The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59903 is a vulnerability in Netty's CorsHandler where the setVaryHeader method replaces existing Vary headers like Authorization or Cookie with Origin. This causes caching proxies or CDNs to reuse authenticated responses across users, potentially disclosing sensitive information.

Detection Guidance

To detect this vulnerability, check if your Netty version is between 4.1.136.Final or earlier and 4.2.16.Final. Use commands like 'find / -name netty-*.jar' to locate Netty JAR files and inspect their version numbers.

Impact Analysis

This vulnerability allows attackers to remotely exploit cache poisoning and information disclosure. Sensitive data from one user may be cached and exposed to unauthorized parties due to improper handling of Vary headers by caching systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using affected Netty versions may face compliance violations and data breach liabilities.

Mitigation Strategies

Upgrade Netty to version 4.1.137.Final or later, or 4.2.17.Final or later. If upgrading is not possible, disable CorsHandler or configure it to avoid overwriting Vary headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart