Netty: Security Control Bypass via CORS Short-Circuit Failure

🗓️ 22 Jul 2026 21:42:17Reported by GitHub Advisory DatabaseType

Netty CorsHandler short-circuit can be bypassed by Origin: null, exposing unauthorized requests.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Vulnerabilities reported in netty-codec-4.1.135.Final.jar for APIM	4 Oct 202617:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.135.Final.jar	15 Sep 202620:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	2 Nov 202614:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	6 Nov 202604:30	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	10 Sep 202621:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and open62541	7 Aug 202613:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (October 2026 - Part 2 of 2)	20 Oct 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE might affect IBM Storage Defender Copy Data Management	30 Sep 202617:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty	22 Oct 202619:46	–	ibm

Vulners

Node

io.netty netty-codec-httpRange<4.1.136.Finalmaven

io.netty netty-codec-httpRange4.2.0.Final–4.2.16.Finalmaven

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56746
github	www.github.com/netty/netty/releases/tag/netty-4.1.136.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/advisories/GHSA-6cqp-g7gg-8hr5

22 Jul 2026 21:42Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

EPSS0.00408

SSVC

CWE-284