CVE-2026-59903: Cache Poisoning and Information Disclosure via CorsHandler Vary Header Overwrite
Vulnerability ID: CVE-2026-59903
CVSS Score: 6.5
Published: 2026-08-17
A technical analysis of CVE-2026-59903 in Netty's HTTP CORS handler, where the CorsHandler overwrites existing application Vary headers with Origin, leading to unauthorized caching of sensitive information.
TL;DR
Netty's CorsHandler replaces application-defined Vary headers with Origin, allowing downstream caching proxies to cache private user sessions and expose them to unauthorized clients.
Technical Details
- CWE ID: CWE-524
- Attack Vector: Network
- Attack Complexity: High
- CVSS Score: 6.5
- Exploit Status: None
- Impact: Information Disclosure / Confidentiality (High)
Affected Systems
- Netty Http Codec
- Applications utilizing io.netty:netty-codec-http and CorsHandler
-
netty-codec-http: < 4.1.137.Final (Fixed in:
4.1.137.Final) -
netty-codec-http: >= 4.2.0.Final, < 4.2.17.Final (Fixed in:
4.2.17.Final)
Code Analysis
Commit: a68d0ee
Fix CorsHandler setVaryHeader replacing instead of appending
@@ -193,7 +193,9 @@
- response.headers().set(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);
+ if (!response.headers().containsValue(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN, true)) {
+ response.headers().add(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);
+ }
Mitigation Strategies
- Upgrade Netty dependencies to safe versions.
- Deploy virtual patching at CDN or reverse proxy level.
- Implement a custom downstream Netty handler to restore critical Vary values.
Remediation Steps:
- Identify any usage of CorsHandler in the Netty channel pipeline.
- Update maven or gradle build files to pull io.netty:netty-codec-http version 4.1.137.Final or 4.2.17.Final.
- Verify that outbound responses retain original Vary values such as Authorization or Cookie alongside Origin.
References
Read the full report for CVE-2026-59903 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)