CVE-2026-62380
Received Received - Intake

Null Byte Injection in Netty SOCKS Client Encoders

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-62380
EUVD
EUVD-2026-64272

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
io.netty netty-codec-socks From 4.1.0 (inc) to 4.2.16.Final (inc)
io.netty netty-codec-socks 4.2.17.Final
io.netty netty-codec-socks 4.1.137.Final
netty netty_codec_socks From 4.2.0.Final (inc) to 4.2.16.Final (inc)
netty netty_codec_socks From 4.1.0.Final (inc) to 4.1.136.Final (inc)
netty netty_codec_socks 4.2.17.Final
netty netty_codec_socks 4.1.137.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-626 The product does not properly handle null bytes or NUL characters when passing data between different representations or components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Netty's SOCKS4 and SOCKS5 proxy client encoders in versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final. The encoders fail to validate domain address and authentication fields, allowing attackers to inject null bytes or CRLF characters. This can lead to domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion.

Detection Guidance

To detect this vulnerability, check the version of Netty's netty-codec-socks library in use. Vulnerable versions are 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final. Use commands like 'mvn dependency:tree' in Maven projects or 'gradle dependencies' in Gradle projects to inspect dependencies.

Impact Analysis

An attacker could exploit this to manipulate proxy connections, redirect traffic to malicious servers, bypass authentication, or cause protocol confusion. This may result in unauthorized access, data leaks, or SSRF attacks if combined with domain spoofing to target internal hosts.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling domain spoofing, authentication bypass, and SSRF attacks. These issues may lead to unauthorized data access, data exfiltration, or exposure of sensitive information, which are critical violations under both regulations.

Mitigation Strategies

Immediately upgrade Netty's netty-codec-socks library to version 4.2.17.Final or later, or 4.1.137.Final or later. If upgrading is not possible, disable SOCKS4/5 proxy functionality until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart