Loading story…
Netty patched a locale-dependent bug in its HTTP and RTSP parsing code that caused valid protocol strings to fail on Turkish-language JVMs. The flaw affected HttpVersion, RtspMethods, and RtspVersions, where String.toUpperCase() was used without an explicit locale; under tr_TR, ASCII i could be converted to Unicode İ (U+0130), breaking parsing for inputs such as describe, redirect, and icap/1.0 and producing malformed protocol names.
The project fixed the issue by replacing locale-sensitive uppercasing with String.toUpperCase(Locale.US) in the affected classes, aligning normalization with the ASCII-only requirements in RFC 7230 and RFC 2326. The change was merged for the 5.0 branch and reflected in the 4.2.14.Final release comparison, with new tests reproducing the Turkish-locale failure and confirming correct canonical parsing under both US and Turkish locales; the reported test run passed with 52 tests and no failures.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Netty updated `HttpVersion`, `RtspMethods`, and `RtspVersions` to use `String.toUpperCase(Locale.US)` instead of locale-dependent uppercasing, fixing protocol parsing failures on Turkish-locale JVMs. Tests were added to reproduce the issue under `tr_TR` and verify correct ASCII normalization, with the reported test run passing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceredirect.github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Netty released versions **4.2.17.Final** and **4.1.137.Final** with security hardening and vulnerability fixes across its HTTP, SCTP, compression, TLS, MQTT, and SOCKS components. The most prominent issue, tracked as **CVE-2026-59903**, affects `io.netty.handler.codec.http.cors.CorsHandler`, which overwrote existing `Vary` headers with `Vary: Origin`. That behavior could strip cache-partitioning headers such as `Authorization` or `Cookie`, enabling cache poisoning and exposing authenticated content through shared proxies, reverse proxies, or CDNs. The fix preserves existing `Vary` semantics by appending `Origin` only when needed. The releases also address **CVE-2026-59902** in `SctpMessageCompletionHandler`, where fragmented SCTP messages could consume excessive heap or direct memory because buffered bytes were not fully capped, creating a denial-of-service risk. Netty added a `maxBufferedBytes` ceiling with a default limit of **16 MB** and bundled additional hardening, including stricter validation for malformed MQTT and SOCKS inputs, safer TLS `ClientHello` parsing, trust manager compatibility checks, safer decompression in `Lz4FrameDecoder`, protection against invalid Snappy chunk lengths, and fixes for buffer, memory, and classloader leaks.
Aug 20, 2026
Netty released **4.1.135.Final** and **4.2.15.Final** to patch a large batch of security vulnerabilities across core networking components, with fixes spanning `netty-resolver-dns`, `netty-codec-http2`, `netty-handler`, `netty-codec-redis`, `netty-codec-haproxy`, native transports, and SCTP support. The DNS resolver fixes address multiple cache-poisoning paths, including predictable transaction IDs combined with a static UDP source port, missing bailiwick checks for **CNAME** records, and insufficient validation of **NS** records; one of those issues was later tracked as **CVE-2026-45674**. Netty also fixed a TLS flaw in which wrapping a plain `X509TrustManager` could silently disable hostname verification for clients, and an IPv6 access-control bypass in `IpSubnetFilterRule`, later assigned **CVE-2026-44249**.
Aug 20, 2026
Netty corrected an MQTT decoder regression introduced during remediation for **`CVE-2026-44248`**, after the library began incorrectly rejecting valid fragmented or batched MQTT packets with **`TooLongFrameException`**. The flaw came from using `readableBytes()` inside a `ReplayingDecoder` path, where the value reflected the cumulation buffer or an effectively unbounded readable size instead of the current packet’s declared remaining length during variable-header replay handling. The project fixed the logic in pull request **#16787** by basing the size check on **`bytesRemainingBeforeVariableHeader`** and added regression tests covering both valid in-limit packets and oversized packets. The fix was merged into the **4.2** branch for release in **`4.2.14.Final`**, then auto-ported to **4.1** in **#16838** and later re-applied in **#16916** after a subsequent security merge reintroduced the broken code. Netty also addressed a related `ReplayingDecoder` `readableBytes()` issue in **#16813** and auto-port **#16919**, ensuring early replay handling works correctly for incomplete MQTT properties blocks. Downstream projects including **ArcadeDB** and **ThingsBoard** referenced or adopted the updated Netty releases to resolve the decoder behavior.
Jun 29, 2026