CVE-2026-42578High· 7.5▾ MidnightPoC availableNetty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
0.9% → 1.1%
Exploit / PoC code exists
Last analysed / modified upstream
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
netty < 4.1.133netty >= 4.2.0, < 4.2.13Upgrade past the affected range:
netty 4.2.13Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44248Medium· 5.3Netty is an asynchronous, event-driven network application framework
CVE-2026-42584High· 7.3Netty is an asynchronous, event-driven network application framework
CVE-2026-42581Medium· 5.8Netty is an asynchronous, event-driven network application framework
CVE-2026-42579High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2026-50011High· 7.5Netty is a network application framework for development of protocol servers and clients
CVE-2026-48043Medium· 5.3Netty is a network application framework for development of protocol servers and clients