PT-2026-62421 · Netty · Netty

CVE-2026-56746 · Published 2026-07-21 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final

Description A security control bypass exists during the origin evaluation process. The CorsHandler includes a shortCircuit() configuration intended to immediately reject unauthorized cross-origin requests before they reach the application. Due to a logical operator error, an attacker can bypass this mechanism by sending a request with an Origin header set to null. This allows unauthorized requests to be forwarded to the backend application, bypassing intended access controls.

Recommendations Update to version 4.1.136.Final Update to version 4.2.16.Final

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-56746

GHSA-6CQP-G7GG-8HR5

Affected Products

Netty

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56746.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-56746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56746 · Security Note
• https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5 · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note