Skip to content
Heist/ feed
Back to feed
Medium

Netty has a Security Control Bypass via CORS Short-Circuit Failure

Type: advisorySources: OSV

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-56746
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 04:45 UTC · Revision 1

Source evidence

Netty has a Security Control Bypass via CORS Short-Circuit Failure

core-osv · Original source

Published 21 Jul 2026, 21:36 UTC

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

osv:CVE-2026-56746
Complete source record
{
  "id": "5ef56c4f4334850eed98ddfb00faff62b8c5a779de739f6da522e558b3977521",
  "url": "https://osv.dev/vulnerability/CVE-2026-56746",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Netty has a Security Control Bypass via CORS Short-Circuit Failure",
    "summary": "Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
    "evidence": "osv:CVE-2026-56746",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-56746",
      "aliases": [
        "CVE-2026-56746",
        "GHSA-6cqp-g7gg-8hr5"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/netty/netty",
              "type": "GIT",
              "events": [
                {
                  "introduced": "446b38db5220a3934064ee4e26f40d81dfa6b714"
                },
                {
                  "fixed": "fca0764703b3bb59c6e6dc5d29c6d9710d35c0e6"
                },
                {
                  "introduced": "09e64d259c99be8b5b2a471a78f11e65eb82598a"
                },
                {
                  "fixed": "3703d79669ee024f6483c9d8697ac58ba546df33"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "4.1.0"
                      },
                      {
                        "fixed": "4.1.136"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "4.2.0"
                      },
                      {
                        "fixed": "4.2.16"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "fca0764703b3bb59c6e6dc5d29c6d9710d35c0e6"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "netty-4.1.136.Final"
                  },
                  {
                    "range": [
                      {
                        "fixed": "3703d79669ee024f6483c9d8697ac58ba546df33"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "netty-4.2.16.Final"
                  }
                ]
              }
            }
          ],
          "versions": [
            "netty-4.1.135.Final",
            "netty-4.2.15.Final",
            "netty-4.1.134.Final",
            "netty-4.2.14.Final",
            "netty-4.1.133.Final",
            "netty-4.2.13.Final",
            "netty-4.2.12.Final",
            "netty-4.1.132.Final",
            "netty-4.2.11.Final",
            "netty-4.1.131.Final",
            "netty-4.2.10.Final",
            "netty-4.2.9.Final",
            "netty-4.1.130.Final",
            "netty-4.2.8.Final",
            "netty-4.1.129.Final",
            "netty-4.1.128.Final",
            "netty-4.2.7.Final",
            "netty-4.2.6.Final",
            "netty-4.1.127.Final",
            "netty-4.2.5.Final",
            "netty-4.1.126.Final",
            "netty-4.1.125.Final",
            "netty-4.2.4.Final",
            "netty-4.1.124.Final",
            "netty-4.1.123.Final",
            "netty-4.2.3.Final",
            "netty-4.2.2.Final",
            "netty-4.1.122.Final",
            "netty-4.2.1.Final",
            "netty-4.1.121.Final",
            "netty-4.1.120.Final",
            "netty-4.2.0.Final",
            "netty-4.1.119.Final",
            "netty-4.1.118.Final",
            "netty-4.1.117.Final",
            "netty-4.1.116.Final",
            "netty-4.1.115.Final",
            "netty-4.1.114.Final",
            "netty-4.1.113.Final",
            "netty-4.1.112.Final",
            "netty-4.1.111.Final",
            "netty-4.1.110.Final",
            "netty-4.1.109.Final",
            "netty-4.1.108.Final",
            "netty-4.1.107.Final",
            "netty-4.1.106.Final",
            "netty-4.1.105.Final",
            "netty-4.1.104.Final",
            "netty-4.1.103.Final",
            "netty-4.1.102.Final",
            "netty-4.1.101.Final",
            "netty-4.1.100.Final",
            "netty-4.1.99.Final",
            "netty-4.1.98.Final",
            "netty-4.1.97.Final",
            "netty-4.1.96.Final",
            "netty-4.1.95.Final",
            "netty-4.1.94.Final",
            "netty-4.1.93.Final",
            "netty-4.1.92.Final",
            "netty-4.1.91.Final",
            "netty-4.1.90.Final",
            "netty-4.1.89.Final",
            "netty-4.1.88.Final",
            "netty-4.1.87.Final",
            "netty-4.1.86.Final",
            "netty-4.1.85.Final",
            "netty-4.1.84.Final",
            "netty-4.1.83.Final",
            "netty-4.1.82.Final",
            "netty-4.1.81.Final",
            "netty-4.1.80.Final",
            "netty-4.1.79.Final",
            "netty-4.1.78.Final",
            "netty-4.1.77.Final",
            "netty-4.1.76.Final",
            "netty-4.1.75.Final",
            "netty-4.1.74.Final",
            "netty-4.1.73.Final",
            "netty-4.1.72.Final",
            "netty-4.1.71.Final",
            "netty-4.1.70.Final",
            "netty-4.1.69.Final",
            "netty-4.1.68.Final",
            "netty-4.1.67.Final",
            "netty-4.1.66.Final",
            "netty-4.1.65.Final",
            "netty-4.1.64.Final",
            "netty-4.1.63.Final",
            "netty-4.1.62.Final",
            "netty-4.1.61.Final",
            "netty-4.1.60.Final",
            "netty-4.1.59.Final",
            "netty-4.1.58.Final",
            "netty-4.1.57.Final",
            "netty-4.1.56.Final",
            "netty-4.1.55.Final",
            "netty-4.1.54.Final",
            "netty-4.1.53.Final",
            "netty-4.1.52.Final",
            "netty-4.1.51.Final",
            "netty-4.1.50.Final",
            "netty-4.1.49.Final",
            "netty-4.1.48.Final",
            "netty-4.1.47.Final",
            "netty-4.1.46.Final",
            "netty-4.1.45.Final",
            "netty-4.1.44.Final",
            "netty-4.1.43.Final",
            "netty-4.1.42.Final",
            "netty-4.1.41.Final",
            "netty-4.1.40.Final",
            "netty-4.1.39.Final",
            "netty-4.1.38.Final",
            "netty-4.1.37.Final",
            "netty-4.1.36.Final",
            "netty-4.1.35.Final",
            "netty-4.1.34.Final",
            "netty-4.1.33.Final",
            "netty-4.1.32.Final",
            "netty-4.1.31.Final",
            "netty-4.1.30.Final",
            "netty-4.1.29.Final",
            "netty-4.1.28.Final",
            "netty-4.1.27.Final",
            "netty-4.1.26.Final",
            "netty-4.1.25.Final",
            "netty-4.1.24.Final",
            "netty-4.1.23.Final",
            "netty-4.1.22.Final",
            "netty-4.1.21.Final",
            "netty-4.1.20.Final",
            "netty-4.1.19.Final",
            "netty-4.1.18.Final",
            "netty-4.1.17.Final",
            "netty-4.1.16.Final",
            "netty-4.1.15.Final",
            "netty-4.1.14.Final",
            "netty-4.1.13.Final",
            "netty-4.1.12.Final",
            "netty-4.1.11.Final",
            "netty-4.1.10.Final",
            "netty-4.1.9.Final",
            "netty-4.1.8.Final",
            "netty-4.1.7.Final",
            "netty-4.1.6.Final",
            "netty-4.1.5.Final",
            "netty-4.1.4.Final",
            "netty-4.1.3.Final",
            "netty-4.1.2.Final",
            "netty-4.1.1.Final",
            "netty-4.1.0.Final"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56746.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:33.249369550Z",
      "provider": "osv",
      "references": [
        "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
        "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56746.json",
        "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-56746"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-284"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56746.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-56746",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 500378,
  "published_at": "2026-07-21T21:36:18.627+00:00"
}