Netty 4.1-4.2 Bypass CorsHandler shortCircuit() (fixed 4.1.136/4.2.16)
CVE-2026-56746 Published on July 21, 2026
Netty has a Security Control Bypass via CORS Short-Circuit Failure
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Vulnerability Analysis
CVE-2026-56746 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-56746 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2026-56746
stack.watch emails you whenever new vulnerabilities are published in Netty or Red Hat Kafka. Just hit a watch button to start following.
Affected Versions
netty:- Version >= 4.2.0.Final, < 4.2.16.Final is affected.
- Version >= 4.1.0.Final, < 4.1.136.Final is affected.