MIME Header Injection in Netty Framework Due to Insecure Filename Handling

CVE-2026-59921

What is CVE-2026-59921?

The Netty Framework contains a vulnerability in the HttpPostRequestEncoder responsible for constructing multipart HTTP request bodies. Prior to versions 4.1.136.Final and 4.2.16.Final, the encoder improperly concatenated user-supplied filenames and field names into Content-Disposition MIME headers without appropriate validation or sanitization of CRLF characters. This design flaw allows attackers controlling the filename to inject arbitrary MIME headers into the multipart body. The vulnerable methods, particularly setFilename(), lacked sufficient checks to neutralize CRLF characters, enabling the injection risk. This vulnerability has been addressed in later versions, reinforcing application security and mitigating potential exploitation.

References