Netty: Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin… (CVE-2026-56746)
Description
Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final contain a vulnerability in the CorsHandler component. A logical error in handling the 'Origin: null' header allows bypassing the intended short-circuit rejection of unauthorized cross-origin requests. This flaw can cause unauthorized requests to reach backend applications relying on this feature for access control.
CVSS v3.1
Score 6.5medium
Affected software
pkg:deb/ubuntu/netty?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/netty?arch=source&distro=esm-apps-legacy/xenialpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/netty?arch=source&distro=stonkingpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-56746) affects Netty's CorsHandler, which is designed to reject unauthorized cross-origin requests via a short-circuit mechanism. Due to a logical error, when the 'Origin' header is set to 'null', the method incorrectly returns a configuration object regardless of developer settings. This bypass allows unauthorized cross-origin requests to be processed by backend applications that depend on this mechanism for security.
Potential Impact
Applications using the vulnerable Netty versions and relying on CorsHandler's short-circuit feature for cross-origin request access control may process unauthorized requests. This could lead to unauthorized actions or data exposure within the affected backend systems. The CVSS score of 6.5 (medium severity) reflects the potential for integrity impact without confidentiality or availability loss.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, developers should review their use of CorsHandler, especially how 'Origin: null' headers are handled, and consider implementing additional access control checks outside of CorsHandler to prevent unauthorized cross-origin requests.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6cqp-g7gg-8hr5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-56746"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a6150d69c2644c7f8da0c46
Added to database: 07/22/2026, 23:23:02 UTC
Last enriched: 10/18/2026, 04:44:25 UTC
Last updated: 10/21/2026, 13:20:22 UTC
Views: 96
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.