Vulnerability · Published Aug 22, 2026 · Assigned by VulnCheck

CVE-2026-62380Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Medium 6.3

In plain English

A medium-severity security flaw in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.3%top 83.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	netty	no fix listed	DEBIAN-CVE-2026-62380
Debian:13	netty	no fix listed	DEBIAN-CVE-2026-62380
Debian:14	netty	no fix listed	DEBIAN-CVE-2026-62380
Ubuntu:26.10	netty	no fix listed	UBUNTU-CVE-2026-62380

Affected products (as reported)

Vendor	Product	Versions
netty	netty	4.2.0.Final – before 4.2.16.Final
netty	netty	0 – before 4.1.137.Final

Weakness: CWE-626 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

GitHub Security Advisory (GHSA-cc6x-ffm5-83wf) vendor-advisory
VulnCheck Advisory: Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection third-party-advisory