Network Application Framework Vulnerability in Netty from Vendor Netty
CVE-2026-56746

6.5MEDIUM

Key Information:

Vendor

Netty

Status
Netty
Vendor
CVE Published:
21 July 2026

What is CVE-2026-56746?

The vulnerability in Netty arises from a logical error in the origin evaluation process, specifically within the CorsHandler’s shortCircuit() security feature. When an attacker sends a request with an Origin: null header, this misconfiguration allows unauthorized requests to bypass the security controls designed to restrict cross-origin requests. The failure to properly evaluate the origin exposes the backend application to potential malicious exploits, effectively undermining intended access restrictions. This critical oversight necessitates immediate attention, as the only resolution is to upgrade to the patched versions 4.1.136.Final and 4.2.16.Final to maintain the integrity of network applications.

Affected Version(s)

netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final

netty >= 4.1.0.Final, < 4.1.136.Final < 4.1.0.Final, 4.1.136.Final

References

https://github.com/netty/netty/security/advisories/GHSA-6...
x_refsource_CONFIRM
https://github.com/netty/netty/releases/tag/netty-4.1.136...
x_refsource_MISC
https://github.com/netty/netty/releases/tag/netty-4.2.16....
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.