CVE-2026-59903

Analyzed Analyzed - Analysis Complete

CORS Header Manipulation in Netty Framework

Publication date: 2026-08-17

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-09-23

Generated

2026-09-27

AI Q&A

2026-08-17

EPSS Evaluated

2026-09-25

NVD

CVE-2026-59903

EUVD

EUVD-2026-60318

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.1.137 (exc)
netty	netty	From 4.2.0 (inc) to 4.2.17 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-524	The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

CVE-2026-59903 is a vulnerability in Netty's CorsHandler where the setVaryHeader method replaces existing Vary headers like Authorization or Cookie with Origin. This causes caching proxies or CDNs to reuse authenticated responses across users, potentially disclosing sensitive information.

Detection Guidance

To detect this vulnerability, check if your Netty version is between 4.1.136.Final or earlier and 4.2.16.Final. Use commands like 'find / -name netty-*.jar' to locate Netty JAR files and inspect their version numbers.

Impact Analysis

This vulnerability allows attackers to remotely exploit cache poisoning and information disclosure. Sensitive data from one user may be cached and exposed to unauthorized parties due to improper handling of Vary headers by caching systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using affected Netty versions may face compliance violations and data breach liabilities.

Mitigation Strategies

Upgrade Netty to version 4.1.137.Final or later, or 4.2.17.Final or later. If upgrading is not possible, disable CorsHandler or configure it to avoid overwriting Vary headers.

Hi! I’m here to help you understand CVE-2026-59903. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70