Netty fixes CORS cache poisoning and SCTP memory exhaustion flaws
Vulnerability Disclosure · 8 sources · Updated 3mo ago · First seen Aug 17, 2026
Netty released versions 4.2.17.Final and 4.1.137.Final with security hardening and vulnerability fixes across its HTTP, SCTP, compression, TLS, MQTT, and SOCKS components. The most prominent issue, tracked as CVE-2026-59903, affects io.netty.handler.codec.http.cors.CorsHandler, which overwrote existing Vary headers with Vary: Origin. That behavior could strip cache-partitioning headers such as Authorization or Cookie, enabling cache poisoning and exposing authenticated content through shared proxies, reverse proxies, or CDNs. The fix preserves existing Vary semantics by appending Origin only when needed.
The releases also address CVE-2026-59902 in SctpMessageCompletionHandler, where fragmented SCTP messages could consume excessive heap or direct memory because buffered bytes were not fully capped, creating a denial-of-service risk. Netty added a maxBufferedBytes ceiling with a default limit of 16 MB and bundled additional hardening, including stricter validation for malformed MQTT and SOCKS inputs, safer TLS ClientHello parsing, trust manager compatibility checks, safer decompression in Lz4FrameDecoder, protection against invalid Snappy chunk lengths, and fixes for buffer, memory, and classloader leaks.
