CVE-2026-59903

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.137.Final Netty versions prior to 4.2.17.Final

Description The io.netty.handler.codec.http.cors.CorsHandler contains an issue where the setVaryHeader() function replaces existing application Vary headers, such as Authorization or Cookie, with the Origin header. This behavior occurs because the set() method replaces all existing values for the header. When a backend application uses the Vary header to ensure that intermediate caches, such as Content Delivery Networks (CDNs), cache responses separately per user, this overwrite causes the caching proxy to ignore the authorization context. Consequently, the proxy may cache responses based solely on the URL and Origin, potentially allowing unauthorized users to retrieve cached sensitive data from other users through cache poisoning.

Recommendations Update to version 4.1.137.Final or later. Update to version 4.2.17.Final or later.