{"id":"CVE-2026-59903","title":"Netty is an asynchronous, event-driven network application framework","summary":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie w…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-524","CWE-444"],"vendor":"netty","product":"io.netty:netty-codec-http","affected":["io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.16.Final","io.netty:netty-codec-http <= 4.1.136.Final"],"patched":["io.netty:netty-codec-http 4.2.17.Final","io.netty:netty-codec-http 4.1.137.Final"],"published":"2026-08-17","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:43:19.260","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903","references":[{"url":"https://github.com/netty/netty/pull/17213","label":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/pull/17217","label":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","label":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","label":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-8c42-7qj2-3j46"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59903.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59903"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517538"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59903"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59903"}],"tags":["nvd","exploit-available","ghsa","maven","csaf","vex","red-hat"],"epss":0.00245,"epssPercentile":0.15989,"exploits":{"github":1,"githubRepos":["https://github.com/xiaoqiMikko/netty-http-check"],"checkedAt":"2026-09-21T15:29:50.959Z"},"exploitAvailable":true,"aliases":["GHSA-8c42-7qj2-3j46"],"ecosystem":"maven","ingestedAt":"2026-08-17T18:59:03.411Z","slug":"CVE-2026-59903","body":"## Overview\n\nNetty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-59903)\n\nAffected packages:\n\n- `io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.16.Final`\n- `io.netty:netty-codec-http <= 4.1.136.Final`\n\nPatched in:\n\n- `io.netty:netty-codec-http 4.2.17.Final`\n- `io.netty:netty-codec-http 4.1.137.Final`\n\nSource: https://github.com/advisories/GHSA-8c42-7qj2-3j46\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Offline Knowledge Portal, … · no fix planned: Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, … · updated 2026-09-11 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59903.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":201846,"id":"CVE-2026-59903","ts":1789399748322,"field":"exploit_available","old":"false","new":"true"},{"seq":200576,"id":"CVE-2026-59903","ts":1789397412975,"field":"exploit_available","old":"true","new":"false"},{"seq":198493,"id":"CVE-2026-59903","ts":1789392002150,"field":"exploit_available","old":"false","new":"true"},{"seq":196286,"id":"CVE-2026-59903","ts":1789383612692,"field":"exploit_available","old":"true","new":"false"},{"seq":195215,"id":"CVE-2026-59903","ts":1789380497749,"field":"exploit_available","old":"false","new":"true"},{"seq":194002,"id":"CVE-2026-59903","ts":1789378553832,"field":"exploit_available","old":"true","new":"false"},{"seq":192789,"id":"CVE-2026-59903","ts":1789376426648,"field":"exploit_available","old":"false","new":"true"},{"seq":191576,"id":"CVE-2026-59903","ts":1789373459116,"field":"exploit_available","old":"true","new":"false"},{"seq":190361,"id":"CVE-2026-59903","ts":1789369359204,"field":"exploit_available","old":"false","new":"true"},{"seq":189148,"id":"CVE-2026-59903","ts":1789368283596,"field":"exploit_available","old":"true","new":"false"},{"seq":187931,"id":"CVE-2026-59903","ts":1789365162597,"field":"exploit_available","old":"false","new":"true"},{"seq":186718,"id":"CVE-2026-59903","ts":1789363308815,"field":"exploit_available","old":"true","new":"false"},{"seq":185504,"id":"CVE-2026-59903","ts":1789361123626,"field":"exploit_available","old":"false","new":"true"},{"seq":184291,"id":"CVE-2026-59903","ts":1789358182160,"field":"exploit_available","old":"true","new":"false"},{"seq":182542,"id":"CVE-2026-59903","ts":1789354239222,"field":"exploit_available","old":"false","new":"true"},{"seq":181335,"id":"CVE-2026-59903","ts":1789353164945,"field":"exploit_available","old":"true","new":"false"},{"seq":180128,"id":"CVE-2026-59903","ts":1789350187956,"field":"exploit_available","old":"false","new":"true"},{"seq":178921,"id":"CVE-2026-59903","ts":1789348123551,"field":"exploit_available","old":"true","new":"false"},{"seq":177714,"id":"CVE-2026-59903","ts":1789346294266,"field":"exploit_available","old":"false","new":"true"},{"seq":176507,"id":"CVE-2026-59903","ts":1789343057713,"field":"exploit_available","old":"true","new":"false"},{"seq":174624,"id":"CVE-2026-59903","ts":1789334801837,"field":"exploit_available","old":"false","new":"true"},{"seq":173419,"id":"CVE-2026-59903","ts":1789333533834,"field":"exploit_available","old":"true","new":"false"},{"seq":172233,"id":"CVE-2026-59903","ts":1789331031245,"field":"exploit_available","old":"false","new":"true"},{"seq":171047,"id":"CVE-2026-59903","ts":1789328647259,"field":"exploit_available","old":"true","new":"false"},{"seq":169842,"id":"CVE-2026-59903","ts":1789327070665,"field":"exploit_available","old":"false","new":"true"},{"seq":168637,"id":"CVE-2026-59903","ts":1789323689617,"field":"exploit_available","old":"true","new":"false"},{"seq":167432,"id":"CVE-2026-59903","ts":1789319601398,"field":"exploit_available","old":"false","new":"true"},{"seq":166227,"id":"CVE-2026-59903","ts":1789318593219,"field":"exploit_available","old":"true","new":"false"},{"seq":165022,"id":"CVE-2026-59903","ts":1789315721784,"field":"exploit_available","old":"false","new":"true"},{"seq":163817,"id":"CVE-2026-59903","ts":1789313482989,"field":"exploit_available","old":"true","new":"false"},{"seq":162612,"id":"CVE-2026-59903","ts":1789311827608,"field":"exploit_available","old":"false","new":"true"},{"seq":161407,"id":"CVE-2026-59903","ts":1789308552694,"field":"exploit_available","old":"true","new":"false"},{"seq":160912,"id":"CVE-2026-59903","ts":1789304509960,"field":"exploit_available","old":"false","new":"true"},{"seq":160459,"id":"CVE-2026-59903","ts":1789304014830,"field":"exploit_available","old":"true","new":"false"},{"seq":159520,"id":"CVE-2026-59903","ts":1789300417920,"field":"exploit_available","old":"false","new":"true"},{"seq":158750,"id":"CVE-2026-59903","ts":1789299522514,"field":"exploit_available","old":"true","new":"false"},{"seq":157714,"id":"CVE-2026-59903","ts":1789296587441,"field":"exploit_available","old":"false","new":"true"},{"seq":156509,"id":"CVE-2026-59903","ts":1789294619213,"field":"exploit_available","old":"true","new":"false"},{"seq":155304,"id":"CVE-2026-59903","ts":1789292822734,"field":"exploit_available","old":"false","new":"true"},{"seq":154099,"id":"CVE-2026-59903","ts":1789289636537,"field":"exploit_available","old":"true","new":"false"},{"seq":152749,"id":"CVE-2026-59903","ts":1789281539743,"field":"exploit_available","old":"false","new":"true"},{"seq":152389,"id":"CVE-2026-59903","ts":1789281144275,"field":"exploit_available","old":"true","new":"false"},{"seq":151350,"id":"CVE-2026-59903","ts":1789277552090,"field":"exploit_available","old":"false","new":"true"},{"seq":150311,"id":"CVE-2026-59903","ts":1789276127922,"field":"exploit_available","old":"true","new":"false"},{"seq":149278,"id":"CVE-2026-59903","ts":1789273760573,"field":"exploit_available","old":"false","new":"true"},{"seq":148245,"id":"CVE-2026-59903","ts":1789271154985,"field":"exploit_available","old":"true","new":"false"},{"seq":146280,"id":"CVE-2026-59903","ts":1789269289452,"field":"exploit_available","old":"false","new":"true"},{"seq":142892,"id":"CVE-2026-59903","ts":1789261390704,"field":"exploit_available","old":"true","new":"false"},{"seq":141723,"id":"CVE-2026-59903","ts":1789258757179,"field":"exploit_available","old":"false","new":"true"},{"seq":140564,"id":"CVE-2026-59903","ts":1789256594815,"field":"exploit_available","old":"true","new":"false"}]}