CVE-2026-59903 Overview
CVE-2026-59903 affects Netty, an asynchronous event-driven network application framework used widely in Java-based network services. The vulnerability resides in io.netty.handler.codec.http.cors.CorsHandler, where the setVaryHeader method overwrites existing Vary response headers such as Authorization or Cookie with Origin. When responses transit a caching proxy or content delivery network (CDN), the cache key loses the credential dimension. Downstream users can then receive cached responses generated for authenticated sessions belonging to other users. The flaw is classified under [CWE-524: Use of Cache Containing Sensitive Information]. Netty releases 4.1.137.Final and 4.2.17.Final remediate the issue.
Critical Impact
A caching proxy or CDN may reuse authenticated responses across unrelated users, disclosing session-scoped data such as account details, tokens, and personal information.
Affected Products
- Netty 4.1.x prior to 4.1.137.Final
- Netty 4.2.x prior to 4.2.17.Final
- Applications using io.netty.handler.codec.http.cors.CorsHandler behind shared caches
Discovery Timeline
- 2026-08-17 - CVE-2026-59903 published to NVD
- 2026-08-17 - Last updated in NVD database
Technical Details for CVE-2026-59903
Vulnerability Analysis
The CorsHandler in Netty adds an Origin value to the response Vary header to signal that CORS-negotiated responses depend on the request origin. The setVaryHeader implementation replaces any existing Vary header rather than appending to it. Applications commonly set Vary: Authorization or Vary: Cookie to prevent shared caches from serving authenticated content to unrelated clients. After CorsHandler executes, only Vary: Origin remains on the response. A caching proxy or CDN then computes cache keys using origin alone, ignoring the credential-bearing headers that would otherwise segment cached entries per user.
Root Cause
The root cause is destructive header assignment. Netty writes the CORS Vary value using a set operation that clears prior entries instead of an append operation that preserves them. HTTP semantics require Vary to list every request header that influences response selection. Dropping credential-related tokens violates [RFC 7234 Section 4.1] and enables cache poisoning of the shared-cache namespace with authenticated content.
Attack Vector
Exploitation requires an intermediary cache between the vulnerable Netty application and clients. An attacker sends an authenticated request that generates a user-specific response. The proxy caches the response keyed only on Origin. A second user issuing a request with a matching Origin value receives the cached response containing the first user's data. The attack does not require authentication from the attacker and executes over the network path already trusted by the application. See the GitHub Security Advisory GHSA-8c42-7qj2-3j46 for advisory details.
Detection Methods for CVE-2026-59903
Indicators of Compromise
- Response headers containing Vary: Origin on endpoints that previously emitted Vary: Authorization or Vary: Cookie.
- Cache hits from shared proxies or CDNs returning user-specific payloads to requests with mismatched session cookies or bearer tokens.
- Access logs showing identical response bodies delivered to distinct authenticated identities within a short cache TTL window.
Detection Strategies
- Inventory services embedding Netty and confirm versions against 4.1.137.Final and 4.2.17.Final using dependency scanners such as mvn dependency:tree or SBOM tooling.
- Instrument HTTP egress with a response filter that logs the final Vary header on routes protected by CorsHandler.
- Replay authenticated requests through the CDN with varying credentials but identical Origin values and compare responses for identity bleed-through.
Monitoring Recommendations
- Alert on cache hit ratios that spike on authenticated endpoints, which can signal cross-user cache reuse.
- Track CDN log fields exposing cache key composition and flag entries missing credential-derived variance.
- Correlate authentication events with downstream cache behavior to identify session data served to unrelated identifiers.
How to Mitigate CVE-2026-59903
Immediate Actions Required
- Upgrade Netty to 4.1.137.Final or 4.2.17.Final.
- Purge shared caches and CDN edges that received traffic from the vulnerable services to eliminate poisoned entries.
- Audit CORS-enabled routes for authenticated responses and mark them non-cacheable until the patch is deployed.
Patch Information
The fix is delivered in Netty 4.1.137.Final and 4.2.17.Final. The changes are tracked in GitHub Pull Request #17213 and GitHub Pull Request #17217, which modify setVaryHeader to append Origin to any pre-existing Vary header rather than overwrite it.
Workarounds
- Add a downstream response filter that appends Authorization and Cookie back onto the Vary header after CorsHandler executes.
- Set Cache-Control: private, no-store on all responses returned by CORS-enabled authenticated endpoints.
- Configure CDN or reverse proxy cache keys to include credential headers explicitly, overriding any Vary value emitted by the origin.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
