Netty up to 4.1.135.Final/4.2.15.Final CorsHandler shortCircuit Origin cross-domain policy

Summaryinfo

A vulnerability classified as problematic has been found in Netty up to 4.1.135.Final/4.2.15.Final. Affected by this vulnerability is the function shortCircuit of the component CorsHandler. Performing a manipulation of the argument Origin results in cross-domain policy. This vulnerability was named CVE-2026-56746. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Netty up to 4.1.135.Final/4.2.15.Final. This affects the function shortCircuit of the component CorsHandler. The manipulation of the argument Origin with an unknown input leads to a cross-domain policy vulnerability. CWE is classifying the issue as CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. This is going to have an impact on confidentiality. The summary by CVE is:

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-56746 since 06/22/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 4.1.136.Final or 4.2.16.Final eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Netty

Version

• 4.1.135.Final
• 4.2.15.Final

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion