CVE-2026-59921

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description Netty's HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF (Carriage Return Line Feed) characters. CRLF characters are used as delimiters for MIME headers, allowing an attacker who controls the filename to inject arbitrary MIME headers into the multipart body part. This occurs because the encoder and the setFilename() methods in DiskFileUpload, MemoryFileUpload, and MixedFileUpload do not neutralize these characters. This can lead to Content-Type spoofing, stored Cross-Site Scripting (XSS) by overriding the file type to HTML, or the injection of custom headers that may affect downstream middleware and application logic.

Recommendations Update Netty to version 4.1.136.Final or later. Update Netty to version 4.2.16.Final or later. As a temporary mitigation, restrict the use of the HttpPostRequestEncoder or implement manual CRLF sanitization on all user-supplied filenames and field names before they are processed by the encoder.