Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential… (CVE-2026-62380)
Netty versions 4.2.0.Final through 4.2.16.Final and 4.1.0 through 4.1.136.Final contain vulnerabilities in SOCKS4 and SOCKS5 client encoders that allow injection of null bytes, CRLF characters, and credential data due to improper validation of domain address and authentication fields. These flaws can lead to domain spoofing, userid truncation, authentication data injection, and protocol confusion. The issues are fixed in versions 4.2.17.Final and 4.1.137.Final.
AI Analysis
Technical Summary
Netty's io.netty:netty-codec-socks component in versions 4.2.0.Final through 4.2.16.Final and 4.1.0 through 4.1.136.Final has injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders. These encoders fail to properly validate domain address and authentication (username/password) fields, allowing an attacker controlling these fields to inject null bytes or CRLF characters. This can result in truncation or alteration of values, enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. The vulnerabilities are addressed in versions 4.2.17.Final and 4.1.137.Final.
Potential Impact
An attacker who can control the domain address or authentication fields in SOCKS4 or SOCKS5 client encoders can exploit these injection vulnerabilities to manipulate protocol data. This manipulation may lead to domain spoofing, truncation of userid fields, injection of authentication credentials, and confusion in protocol processing. These impacts could undermine the integrity of SOCKS proxy communications and authentication mechanisms.
Mitigation Recommendations
Upgrade affected Netty versions to 4.2.17.Final or later for the 4.2.x branch, or 4.1.137.Final or later for the 4.1.x branch, where these vulnerabilities have been fixed. No other mitigations are indicated by the vendor advisory.
Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential… (CVE-2026-62380)
Description
Netty versions 4.2.0.Final through 4.2.16.Final and 4.1.0 through 4.1.136.Final contain vulnerabilities in SOCKS4 and SOCKS5 client encoders that allow injection of null bytes, CRLF characters, and credential data due to improper validation of domain address and authentication fields. These flaws can lead to domain spoofing, userid truncation, authentication data injection, and protocol confusion. The issues are fixed in versions 4.2.17.Final and 4.1.137.Final.
CVSS v4.0
Affected software
pkg:maven/io.netty/netty-codec-socksRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Netty's io.netty:netty-codec-socks component in versions 4.2.0.Final through 4.2.16.Final and 4.1.0 through 4.1.136.Final has injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders. These encoders fail to properly validate domain address and authentication (username/password) fields, allowing an attacker controlling these fields to inject null bytes or CRLF characters. This can result in truncation or alteration of values, enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. The vulnerabilities are addressed in versions 4.2.17.Final and 4.1.137.Final.
Potential Impact
An attacker who can control the domain address or authentication fields in SOCKS4 or SOCKS5 client encoders can exploit these injection vulnerabilities to manipulate protocol data. This manipulation may lead to domain spoofing, truncation of userid fields, injection of authentication credentials, and confusion in protocol processing. These impacts could undermine the integrity of SOCKS proxy communications and authentication mechanisms.
Mitigation Recommendations
Upgrade affected Netty versions to 4.2.17.Final or later for the 4.2.x branch, or 4.1.137.Final or later for the 4.1.x branch, where these vulnerabilities have been fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jmpc-xv4r-m7fw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-62380"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a8a27fbacd9273b499bca00
Added to database: 08/22/2026, 22:51:39 UTC
Last enriched: 08/22/2026, 22:52:58 UTC
Last updated: 08/23/2026, 01:20:48 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.