REDHAT-BUG-2517538: Medium severity maven/io.netty/netty-handler vulnerability

Q: Which deployments are most exposed to this issue?

Applications using Netty's CorsHandler that set Vary headers such as Authorization or Cookie are exposed when a caching proxy or CDN can cache their authenticated responses. Those intermediaries may then reuse a response for a different user.

Q: How can I determine whether my application is affected?

Check whether the application includes the maven/io.netty/netty-handler component and uses CorsHandler. Versions before 4.1.137.Final or before 4.2.17.Final are affected.

Q: What should be done to remediate the issue?

Update to Netty version 4.1.137.Final or 4.2.17.Final. The provided information does not identify an alternative workaround when updating is not immediately possible.

Published Aug 17, 2026

Updated

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Affected Software

1 affected component

maven/io.netty/netty-handler<4.1.137.Final, <4.2.17.Final

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Netty to a version that resolves this vulnerability.
Fixed in 4.1.137.Final
Upgrade
Upgrade Netty to a version that resolves this vulnerability.
Fixed in 4.2.17.Final

Event History

Aug 17, 2026

Data Sourced

via Red Hat·06:11 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are most exposed to this issue?

Applications using Netty's CorsHandler that set Vary headers such as Authorization or Cookie are exposed when a caching proxy or CDN can cache their authenticated responses. Those intermediaries may then reuse a response for a different user.

How can I determine whether my application is affected?

Check whether the application includes the maven/io.netty/netty-handler component and uses CorsHandler. Versions before 4.1.137.Final or before 4.2.17.Final are affected.

What should be done to remediate the issue?

Update to Netty version 4.1.137.Final or 4.2.17.Final. The provided information does not identify an alternative workaround when updating is not immediately possible.

REDHAT-BUG-2517538: Medium severity maven/io.netty/netty-handler vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

How can I determine whether my application is affected?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

How can I determine whether my application is affected?

What should be done to remediate the issue?