CVE-2026-56746

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-56746

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56746.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-56746

Aliases

GHSA-6cqp-g7gg-8hr5

Published

2026-07-21T21:36:18.627Z

Modified

2026-07-22T05:41:46.365534Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Netty has a Security Control Bypass via CORS Short-Circuit Failure

Details

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56746.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ]
}

References

Affected packages

Git / github.com/netty/netty

Affected ranges

Type

GIT

Repo

https://github.com/netty/netty

Events

Introduced

09e64d259c99be8b5b2a471a78f11e65eb82598a

Fixed

3703d79669ee024f6483c9d8697ac58ba546df33

Introduced

446b38db5220a3934064ee4e26f40d81dfa6b714

Fixed

fca0764703b3bb59c6e6dc5d29c6d9710d35c0e6

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.2.0.Final"
        },
        {
            "fixed": "4.2.16.Final"
        },
        {
            "introduced": "4.1.0.Final"
        },
        {
            "fixed": "4.1.136.Final"
        }
    ]
}

Affected versions

netty-4.*

netty-4.1.0.Final

netty-4.1.1.Final

netty-4.1.10.Final

netty-4.1.100.Final

netty-4.1.101.Final

netty-4.1.102.Final

netty-4.1.103.Final

netty-4.1.104.Final

netty-4.1.105.Final

netty-4.1.106.Final

netty-4.1.107.Final

netty-4.1.108.Final

netty-4.1.109.Final

netty-4.1.11.Final

netty-4.1.110.Final

netty-4.1.111.Final

netty-4.1.112.Final

netty-4.1.113.Final

netty-4.1.114.Final

netty-4.1.115.Final

netty-4.1.116.Final

netty-4.1.117.Final

netty-4.1.118.Final

netty-4.1.119.Final

netty-4.1.12.Final

netty-4.1.120.Final

netty-4.1.121.Final

netty-4.1.122.Final

netty-4.1.123.Final

netty-4.1.124.Final

netty-4.1.125.Final

netty-4.1.126.Final

netty-4.1.127.Final

netty-4.1.128.Final

netty-4.1.129.Final

netty-4.1.13.Final

netty-4.1.130.Final

netty-4.1.131.Final

netty-4.1.132.Final

netty-4.1.133.Final

netty-4.1.134.Final

netty-4.1.135.Final

netty-4.1.14.Final

netty-4.1.15.Final

netty-4.1.16.Final

netty-4.1.17.Final

netty-4.1.18.Final

netty-4.1.19.Final

netty-4.1.2.Final

netty-4.1.20.Final

netty-4.1.21.Final

netty-4.1.22.Final

netty-4.1.23.Final

netty-4.1.24.Final

netty-4.1.25.Final

netty-4.1.26.Final

netty-4.1.27.Final

netty-4.1.28.Final

netty-4.1.29.Final

netty-4.1.3.Final

netty-4.1.30.Final

netty-4.1.31.Final

netty-4.1.32.Final

netty-4.1.33.Final

netty-4.1.34.Final

netty-4.1.35.Final

netty-4.1.36.Final

netty-4.1.37.Final

netty-4.1.38.Final

netty-4.1.39.Final

netty-4.1.4.Final

netty-4.1.40.Final

netty-4.1.41.Final

netty-4.1.42.Final

netty-4.1.43.Final

netty-4.1.44.Final

netty-4.1.45.Final

netty-4.1.46.Final

netty-4.1.47.Final

netty-4.1.48.Final

netty-4.1.49.Final

netty-4.1.5.Final

netty-4.1.50.Final

netty-4.1.51.Final

netty-4.1.52.Final

netty-4.1.53.Final

netty-4.1.54.Final

netty-4.1.55.Final

netty-4.1.56.Final

netty-4.1.57.Final

netty-4.1.58.Final

netty-4.1.59.Final

netty-4.1.6.Final

netty-4.1.60.Final

netty-4.1.61.Final

netty-4.1.62.Final

netty-4.1.63.Final

netty-4.1.64.Final

netty-4.1.65.Final

netty-4.1.66.Final

netty-4.1.67.Final

netty-4.1.68.Final

netty-4.1.69.Final

netty-4.1.7.Final

netty-4.1.70.Final

netty-4.1.71.Final

netty-4.1.72.Final

netty-4.1.73.Final

netty-4.1.74.Final

netty-4.1.75.Final

netty-4.1.76.Final

netty-4.1.77.Final

netty-4.1.78.Final

netty-4.1.79.Final

netty-4.1.8.Final

netty-4.1.80.Final

netty-4.1.81.Final

netty-4.1.82.Final

netty-4.1.83.Final

netty-4.1.84.Final

netty-4.1.85.Final

netty-4.1.86.Final

netty-4.1.87.Final

netty-4.1.88.Final

netty-4.1.89.Final

netty-4.1.9.Final

netty-4.1.90.Final

netty-4.1.91.Final

netty-4.1.92.Final

netty-4.1.93.Final

netty-4.1.94.Final

netty-4.1.95.Final

netty-4.1.96.Final

netty-4.1.97.Final

netty-4.1.98.Final

netty-4.1.99.Final

netty-4.2.0.Final

netty-4.2.1.Final

netty-4.2.10.Final

netty-4.2.11.Final

netty-4.2.12.Final

netty-4.2.13.Final

netty-4.2.14.Final

netty-4.2.15.Final

netty-4.2.2.Final

netty-4.2.3.Final

netty-4.2.4.Final

netty-4.2.5.Final

netty-4.2.6.Final

netty-4.2.7.Final

netty-4.2.8.Final

netty-4.2.9.Final

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56746.json"