CVE-2026-59903: Netty

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Affected products

• Netty Netty: before 4.1.137 (fixed in 4.1.137); from 4.2.0, before 4.2.17 (fixed in 4.2.17)

Published 2026-08-17. Last modified 2026-09-23.