CVE-2026-56746 in Netty
Summary
by MITRE • 07/22/2026
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability in Netty's CorsHandler component represents a critical security control bypass that undermines fundamental web application security mechanisms. This issue affects versions ranging from 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, where the Cross-Origin Resource Sharing (CORS) handling logic contains a logical operator error that fundamentally weakens the security posture of applications relying on this framework. The vulnerability specifically targets the shortCircuit() configuration mechanism designed to immediately reject unauthorized cross-origin requests before they can reach application logic, creating a dangerous pathway for malicious actors to bypass intended access controls.
The technical flaw manifests in the origin evaluation process where the CorsHandler fails to properly validate Origin: null headers that are legitimate parts of the HTTP specification. When an attacker sends a request containing Origin: null, the flawed logical operator processing allows this specific header value to circumvent the short-circuit protection entirely. This occurs because the validation logic does not adequately account for the special case of null origins in its comparison operations, leading to a scenario where unauthorized requests are permitted to proceed through the CORS evaluation chain. The vulnerability is classified under CWE-284 Access Control Bypass, specifically targeting improper access control enforcement during origin validation processes.
The operational impact of this vulnerability extends beyond simple information disclosure, potentially enabling more sophisticated attacks such as cross-site request forgery or data exfiltration from applications that rely on CORS for security boundaries. Applications using Netty's CorsHandler with shortCircuit enabled may experience unauthorized access to protected resources, as legitimate security controls designed to block suspicious cross-origin requests are entirely circumvented. This bypass affects the core security model of CORS implementation within the framework and represents a failure in the principle of least privilege enforcement during origin validation. The vulnerability allows attackers to exploit the very mechanism intended to protect against unauthorized cross-origin access, creating a dangerous scenario where applications may be exposed to malicious requests that would normally be rejected.
Mitigation strategies require immediate upgrade to patched versions 4.1.136.Final and 4.2.16.Final, which correct the logical operator error in the origin evaluation process. Organizations should conduct comprehensive security assessments of their Netty-based applications to identify potential exploitation vectors and ensure all instances are updated promptly. Additionally, implementing additional layers of security controls such as request filtering at reverse proxies, content security policies, and application-level access controls can provide defense-in-depth measures while waiting for complete deployment of patches. The vulnerability aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS to demonstrate the exploitation of protocol handling weaknesses that bypass intended security mechanisms. Security teams should also monitor network traffic for unusual Origin header patterns and implement proper logging of CORS evaluation decisions to detect potential exploitation attempts.