CVE-2026-62380 in Netty
Summary
by MITRE • 08/22/2026
Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/22/2026
The Netty framework, a widely adopted asynchronous event-driven network application framework for Java, contains critical input validation flaws within its SOCKS proxy client implementations. Specifically, versions ranging from 4.2.0.Final through 4.2.16.Final and the legacy 4.1.x series up to 4.1.136.Final are affected by multiple injection vulnerabilities in the Socks4ClientEncoder and Socks5ClientEncoder components. These encoders are responsible for formatting outgoing SOCKS protocol requests, including domain resolution targets and authentication credentials. The core technical flaw lies in the failure of these modules to properly sanitize or validate user-supplied input fields before encoding them into network packets. This lack of rigorous boundary checking allows malicious actors who can influence the destination address or login parameters to inject control characters that disrupt standard parsing logic.
The vulnerabilities manifest primarily through two distinct attack vectors involving null byte injection and carriage return-line feed (CRLF) insertion. In the context of SOCKS4, attackers can exploit null bytes within the username field to truncate the credential string. Since many legacy systems or custom parsers may treat a null character as an end-of-string marker, this truncation effectively bypasses authentication checks if the attacker places their own credentials before the injected null byte. Simultaneously, CRLF injection in both SOCKS4 and SOCKS5 implementations allows for protocol confusion attacks. By injecting newline characters into domain address fields or other headers, an attacker can terminate the current request line prematurely and inject a new HTTP-like header or command sequence. This capability enables domain spoofing where the proxy connects to a malicious server instead of the intended target, effectively turning the compromised Netty application into a man-in-the-middle relay for sensitive data.
The operational impact of these vulnerabilities is severe, particularly in environments where Netty-based applications act as proxies or gateways handling untrusted upstream connections. An attacker with control over input fields can achieve unauthorized access by truncating authentication tokens, thereby bypassing security controls that rely on username-password verification. Furthermore, the ability to inject CRLF sequences facilitates header injection attacks similar to those seen in web application vulnerabilities like HTTP response splitting. This can lead to session hijacking, cache poisoning, or cross-site scripting if the injected content is reflected back to other users through subsequent responses mediated by the proxy. The combination of credential truncation and protocol confusion significantly expands the attack surface, allowing for sophisticated lateral movement within internal networks that rely on SOCKS proxies for traffic routing.
These issues align with Common Weakness Enumeration categories such as CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) and CWE-113 Improper Negotiation of Connection Termination Characteristics, particularly regarding CRLF injection. From an ATT&CK perspective, these vulnerabilities facilitate Initial Access via Exploitation for Credential Access when authentication is bypassed through null byte truncation, and Command and Control via Proxy Abuse if the proxy is manipulated to tunnel malicious traffic. To mitigate these risks, organizations must immediately upgrade Netty dependencies to version 4.2.17.Final or later for the current branch, or 4.1.137.Final and above for the legacy LTS branch. Additionally, developers should implement strict input validation on all domain names and credential fields at the application layer before they reach the encoding modules, ensuring that only alphanumeric characters and standard punctuation are permitted in these specific contexts to prevent any form of control character injection.