CVE-2026-56746 Details
Description
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
A security control bypass vulnerability has been identified in Netty's CORS handling mechanism, specifically in versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. The issue arises in the CorsHandler, which is designed to immediately reject unauthorized cross-origin requests. However, a logical error in the origin evaluation process allows attackers to bypass this protection by sending requests with an 'Origin: null' header. This exploitation forwards unauthorized requests to the backend application, circumventing intended access controls.
Users can upgrade to Netty versions 4.1.136.Final or 4.2.16.Final to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/releases/tag/netty-4.1.136.Final | [email protected] | Release Notes |
| https://github.com/netty/netty/releases/tag/netty-4.2.16.Final | [email protected] | Release Notes |
| https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty | >= 4.1.0, < 4.1.136 >= 4.2.0, < 4.2.16 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |