CVE-2026-59903— Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59903
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
Source: CVE Program / CVE List V5
Vulnerability Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过缓存导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-59903
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59903
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59903 (2)
Vendor Advisories for CVE-2026-59903 (1)
Vendor Pages for CVE-2026-59903 (1)
IV. Related Vulnerabilities
Same product: netty
- CVE-2026-59902
Netty: Memory Exhaustion in SctpMessageCompletionHandler - CVE-2026-73508
Netty: Memory Leak in DNS Record Decoder via Malformed Domai - CVE-2026-73507
Netty: Denial of Service in XmlFrameDecoder via CPU Exhausti - CVE-2026-56818
Netty: RedisArrayAggregator max-elements failure leaves reta - CVE-2026-59898
Netty: WebSockets V07/V08 handshaker missing Connection/Upgr
Same vendor: netty
- CVE-2026-59902
Netty: Memory Exhaustion in SctpMessageCompletionHandler - CVE-2026-73508
Netty: Memory Leak in DNS Record Decoder via Malformed Domai - CVE-2026-73507
Netty: Denial of Service in XmlFrameDecoder via CPU Exhausti - CVE-2026-56818
Netty: RedisArrayAggregator max-elements failure leaves reta - CVE-2026-59898
Netty: WebSockets V07/V08 handshaker missing Connection/Upgr
Same weakness: CWE-524
- CVE-2026-71316
Nuxt runtime payload cache discloses another user's SSR data - CVE-2026-64648
Next.js: Response Body Cache Confusion for Requests Containi - CVE-2026-65755
Joomla Extension - regularlabs.com - Date-sensitive query-ca - CVE-2026-64792
Joomla Extension - regularlabs.com - disclosure of restricte - CVE-2026-61836
Directus: Authorization-dependent response served from unseg
V. Comments for CVE-2026-59903
No comments yet