CVE-2026-62380: Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection
Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-socksto a version that resolves this vulnerability.Fixed in 4.2.17.Final - Upgrade
Upgrade
io.netty:netty-codec-socksto a version that resolves this vulnerability.Fixed in 4.1.137.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Netty io.netty:netty-codec-socks client encoders are affected if they run versions 4.2.0.Final through 4.2.16.Final, or 4.1.x through 4.1.136.Final. The affected components are Socks4ClientEncoder and Socks5ClientEncoder.
What must an attacker control to exploit it?
An attacker must be able to control SOCKS destination domain fields or authentication username/password fields processed by the affected client encoders. Null-byte or CRLF characters in those fields can truncate or alter encoded values and cause protocol confusion or credential injection.
How can I remediate the issue?
Upgrade to Netty 4.2.17.Final or 4.1.137.Final. These releases fix validation of the affected SOCKS domain and authentication fields.
What can be done while an upgrade is pending?
Do not pass attacker-controlled values directly into SOCKS domain, username, or password fields. Validate or reject null-byte and CRLF characters in these inputs before they reach Socks4ClientEncoder or Socks5ClientEncoder.