Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential… (CVE-2026-62380)

Netty's io.netty:netty-codec-socks component in versions 4.2.0.Final through 4.2.16.Final and 4.1.0 through 4.1.136.Final has injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders. These encoders fail to properly validate domain address and authentication (username/password) fields, allowing an attacker controlling these fields to inject null bytes or CRLF characters. This can result in truncation or alteration of values, enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. The vulnerabilities are addressed in versions 4.2.17.Final and 4.1.137.Final.

An attacker who can control the domain address or authentication fields in SOCKS4 or SOCKS5 client encoders can exploit these injection vulnerabilities to manipulate protocol data. This manipulation may lead to domain spoofing, truncation of userid fields, injection of authentication credentials, and confusion in protocol processing. These impacts could undermine the integrity of SOCKS proxy communications and authentication mechanisms.

Upgrade affected Netty versions to 4.2.17.Final or later for the 4.2.x branch, or 4.1.137.Final or later for the 4.1.x branch, where these vulnerabilities have been fixed. No other mitigations are indicated by the vendor advisory.