CVE-2026-59921 Details
Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
A CRLF injection vulnerability has been identified in Netty's HttpPostRequestEncoder component, present in versions through 4.2.15.Final and 4.1.135.Final. The vulnerability arises because the encoder concatenates user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters. This lack of validation allows an attacker to inject arbitrary MIME headers into the multipart body part, potentially leading to header injection, Content-Type spoofing, and stored cross-site scripting (XSS) attacks.
To address this vulnerability, it is recommended to validate filenames in the FileUpload.setFilename() method to ensure they do not contain CRLF characters. Additionally, Netty's HttpPostRequestEncoder can be updated to sanitize CRLF characters when constructing Content-Disposition headers.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g | CISA-ADP | MitigationVendor Advisory |
| https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty | < 4.1.136 >= 4.2.0, < 4.2.16 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Reanalysis | [email protected] |
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 29, 2026 | CVE Modified | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |