CVE-2026-56746: Netty Auth Bypass Vulnerability

CVE-2026-56746 Overview

CVE-2026-56746 is an access control vulnerability [CWE-284] in Netty, an asynchronous event-driven network application framework used to build protocol servers and clients. The flaw affects the CorsHandler component, which is responsible for enforcing Cross-Origin Resource Sharing (CORS) policies. A logical operator error in the origin evaluation routine allows attackers to bypass the shortCircuit() protection by submitting a request containing an Origin: null header. Unauthorized cross-origin requests then reach the backend application instead of being rejected at the framework layer. The issue affects versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, and is fixed in 4.1.136.Final and 4.2.16.Final.

Critical Impact
Attackers can bypass CORS short-circuit enforcement by sending a request with an Origin: null header, exposing protected backend endpoints to unauthorized cross-origin requests.

Affected Products

Netty 4.2.0.Final through 4.2.15.Final
Netty 4.1.0.Final through 4.1.135.Final
Applications embedding the vulnerable CorsHandler component with shortCircuit() enabled

Discovery Timeline

2026-07-21 - CVE-2026-56746 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-56746

Vulnerability Analysis

Netty's CorsHandler exposes a shortCircuit() configuration option that rejects unauthorized cross-origin requests at the framework layer before they reach application handlers. The mechanism is intended as a defense-in-depth control that blocks requests carrying disallowed Origin values with an early HTTP 403 response. Due to a logical operator error inside the origin evaluation routine, the short-circuit decision produces the wrong outcome when the incoming request carries the literal value null in its Origin header. Instead of rejecting the request, the handler forwards it to downstream application logic, bypassing the intended CORS access control.

Root Cause

The root cause is an incorrect boolean condition in the origin validation path of CorsHandler. When the request Origin header equals null, the code path that should mark the request as unauthorized instead evaluates as valid. This is a classic access control weakness classified under [CWE-284]. Browsers legitimately send Origin: null in scenarios such as sandboxed iframes, file:// contexts, and cross-origin redirects, so the header value is trivially reachable by an attacker who controls attacker-hosted HTML.

Attack Vector

Exploitation requires network access to the affected service and user interaction, because the attack is typically staged from an attacker-controlled origin loaded in a victim's browser. An attacker hosts a page that triggers a cross-origin fetch to the target Netty-based service. By causing the browser to emit an Origin: null header (for example, via a sandboxed iframe or a data: document), the request bypasses the CORS short-circuit check. The unauthorized request then reaches backend handlers that assumed the framework had already enforced origin restrictions, enabling state-changing operations against endpoints the application intended to protect. Technical detail is documented in the Netty Security Advisory GHSA-6cqp-g7gg-8hr5.

Detection Methods for CVE-2026-56746

Indicators of Compromise

HTTP requests containing the header Origin: null directed at endpoints protected by CorsHandler.shortCircuit().
Successful 2xx responses to cross-origin requests from origins not on the configured allow list.
Application logs showing backend handler execution for requests that should have been rejected at the CORS layer.

Detection Strategies

Inventory application dependencies for Netty versions in the vulnerable ranges 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final.
Add web application firewall or reverse proxy rules to flag inbound requests where Origin: null targets sensitive API paths.
Instrument the CorsHandler invocation chain to log the resolved origin decision alongside the final HTTP status.

Monitoring Recommendations

Alert on spikes in cross-origin requests carrying Origin: null, particularly against authenticated endpoints.
Correlate authentication and session events with unexpected cross-origin traffic to identify browser-based abuse.
Track upgrade status of Netty across service inventories to confirm patched builds are deployed to production.

How to Mitigate CVE-2026-56746

Immediate Actions Required

Upgrade Netty to 4.1.136.Final or 4.2.16.Final, matching the branch currently in use.
Audit services that rely on CorsHandler.shortCircuit() and confirm backend handlers enforce their own authorization checks.
Block or explicitly deny requests with Origin: null at an upstream reverse proxy or WAF until patched builds are deployed.

Patch Information

The fix is available in the official Netty releases: Netty 4.1.136.Final and Netty 4.2.16.Final. Both releases correct the origin evaluation logic so that requests carrying Origin: null are consistently treated as unauthorized when the short-circuit control is enabled.

Workarounds

Configure the CORS policy to omit null from any allow list and validate origins against an explicit allow list at the application layer.
Enforce authentication and CSRF protections on state-changing endpoints so a CORS bypass alone does not grant meaningful access.
Terminate requests with Origin: null at an upstream proxy for services that do not legitimately require sandboxed-context callers.

bash

# Example: deny Origin: null at an NGINX reverse proxy fronting a Netty service
if ($http_origin = "null") {
    return 403;
}