CVE-2026-59903: Netty Codec HTTP Vulnerable to Cache Poisoning and Information Disclosure

Background

Netty is a popular asynchronous event-driven network application framework that enables quick and efficient development of network applications such as protocol servers and clients. The 'netty-codec-http' package is a crucial component that handles HTTP protocol encoding and decoding. It is widely used in web applications to manage HTTP requests and responses. However, a vulnerability has been identified in the CorsHandler, which can lead to serious security issues when improperly configured.

Vulnerability Detail

The vulnerability arises from the 'CorsHandler' in the 'netty-codec-http' package, which overwrites existing 'Vary' headers in HTTP responses. This behavior allows for cache poisoning, where an attacker can manipulate the caching mechanism of intermediate proxies or CDNs. By replacing critical 'Vary' headers set by backend applications (such as 'Vary: Authorization'), the CorsHandler causes these caches to ignore user-specific contexts, potentially exposing sensitive data to unauthorized users. This vulnerability affects any Netty-based web application that relies on the CorsHandler and uses custom Vary headers for caching authenticated responses.

Workaround

As a temporary workaround, you can manually manage the Vary headers in your application to ensure that critical headers are preserved. For example, you can implement a custom handler that sets the Vary header without overwriting existing values:

public class CustomCorsHandler extends CorsHandler {
    @Override
    protected void setVaryHeader(final HttpResponse response) {
        // Preserve existing Vary headers
        String existingVary = response.headers().get(HttpHeaderNames.VARY);
        if (existingVary != null) {
            response.headers().set(HttpHeaderNames.VARY, existingVary + ", " + HttpHeaderNames.ORIGIN);
        } else {
            response.headers().set(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);
        }
    }
}

Conclusion

The CVE-2026-59903 vulnerability in the Netty 'netty-codec-http' package poses a significant risk to web applications that utilize the CorsHandler. It is crucial to update to the patched versions to mitigate the risk of cache poisoning and information disclosure. Implementing workarounds can provide temporary relief, but updating is the best long-term solution.

See every vulnerability recorded for io.netty:netty-codec-http →

FAQ