CVE-2026-59903

Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

State: Published
Severity: 6.5 Medium
Published: Aug 17, 2026
Updated: Aug 17, 2026
Reserved: Jul 7, 2026

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N	GitHub_M

Weaknesses

CWE-524 Use of Cache Containing Sensitive Information

Affected Products

Product	Versions
nettynetty	< 4.1.137.FinalAffected >= 4.2.0.Final, < 4.2.17.FinalAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.