{"uuid": "25e2a459-e038-4710-b829-996023e71aaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8c42-7qj2-3j46", "type": "seen", "source": "https://gist.github.com/alon710/53c9694ceb5875fbe39960b018952b7c", "content": "# CVE-2026-59903: CVE-2026-59903: Cache Poisoning and Information Disclosure via CorsHandler Vary Header Overwrite\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59903\n\n## Summary\nA technical analysis of CVE-2026-59903 in Netty's HTTP CORS handler, where the CorsHandler overwrites existing application Vary headers with Origin, leading to unauthorized caching of sensitive information.\n\n## TL;DR\nNetty's CorsHandler replaces application-defined Vary headers with Origin, allowing downstream caching proxies to cache private user sessions and expose them to unauthorized clients.\n\n## Technical Details\n\n- **CWE ID**: CWE-524\n- **Attack Vector**: Network\n- **Attack Complexity**: High\n- **CVSS Score**: 6.5\n- **Exploit Status**: None\n- **Impact**: Information Disclosure / Confidentiality (High)\n\n## Affected Systems\n\n- Netty Http Codec\n- Applications utilizing io.netty:netty-codec-http and CorsHandler\n- **netty-codec-http**: < 4.1.137.Final (Fixed in: `4.1.137.Final`)\n- **netty-codec-http**: >= 4.2.0.Final, < 4.2.17.Final (Fixed in: `4.2.17.Final`)\n\n## Mitigation\n\n- Upgrade Netty dependencies to safe versions.\n- Deploy virtual patching at CDN or reverse proxy level.\n- Implement a custom downstream Netty handler to restore critical Vary values.\n\n**Remediation Steps:**\n1. Identify any usage of CorsHandler in the Netty channel pipeline.\n2. Update maven or gradle build files to pull io.netty:netty-codec-http version 4.1.137.Final or 4.2.17.Final.\n3. Verify that outbound responses retain original Vary values such as Authorization or Cookie alongside Origin.\n\n## References\n\n- [GitHub Security Advisory GHSA-8c42-7qj2-3j46](https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46)\n- [Netty Pull Request 17213](https://github.com/netty/netty/pull/17213)\n- [Netty Pull Request 17217](https://github.com/netty/netty/pull/17217)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59903) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-17T19:31:21.677781Z"}