Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M

CVE-2026-56746Netty has a Security Control Bypass via CORS Short-Circuit Failure

Medium 6.5

In plain English

A medium-severity improper access control in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	netty	no fix listed	DEBIAN-CVE-2026-56746
Debian:13	netty	no fix listed	DEBIAN-CVE-2026-56746
Debian:14	netty	no fix listed	DEBIAN-CVE-2026-56746
Maven	io.netty:netty-codec-http	4.2.16.Final	GHSA-6cqp-g7gg-8hr5
Maven	io.netty:netty-codec-http	4.1.136.Final	GHSA-6cqp-g7gg-8hr5
Ubuntu:26.10	netty	no fix listed	UBUNTU-CVE-2026-56746

Affected products (as reported)

Vendor	Product	Versions
netty	netty	>= 4.2.0.Final, < 4.2.16.Final>= 4.1.0.Final, < 4.1.136.Final

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5 x_refsource_CONFIRM
https://github.com/netty/netty/releases/tag/netty-4.1.136.Final x_refsource_MISC
https://github.com/netty/netty/releases/tag/netty-4.2.16.Final x_refsource_MISC