CVE-2026-62380 Overview
CVE-2026-62380 affects the Netty asynchronous network framework, specifically the io.netty:netty-codec-socks module. The vulnerability exists in the Socks4ClientEncoder and Socks5ClientEncoder classes, which fail to validate domain address and authentication fields. Attackers who control these inputs can inject null bytes or CRLF characters to truncate or alter values on the wire. The flaw enables domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion against SOCKS proxies. Netty versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final are affected. The issue is fixed in 4.2.17.Final and 4.1.137.Final.
Critical Impact
Attackers controlling SOCKS client fields can spoof destination domains and inject credentials, redirecting proxied traffic to attacker-controlled hosts.
Affected Products
- Netty io.netty:netty-codec-socks 4.2.0.Final through 4.2.16.Final
- Netty io.netty:netty-codec-socks 4.1.x through 4.1.136.Final
- Applications embedding vulnerable Netty SOCKS client encoders
Discovery Timeline
- 2026-08-22 - CVE-2026-62380 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-62380
Vulnerability Analysis
The vulnerability sits in Netty's SOCKS proxy client encoders. Socks4ClientEncoder writes the destination domain and userid fields directly onto the wire without validating for null bytes or control characters. Socks5ClientEncoder behaves the same way when encoding domain addresses and username/password authentication frames.
An attacker who controls any of these fields, either through a downstream API that forwards user input into a SOCKS request or through a compromised upstream component, can embed \0 or CRLF sequences. The receiving proxy interprets the truncated or altered value as legitimate. This enables domain spoofing, where a request to evil.com\0trusted.com is treated as evil.com by parsers that stop at the null byte.
The class falls under [CWE-626] (Null Byte Interaction Error). Impact is limited to integrity of the proxied connection, with no confidentiality or availability effects on the Netty process itself.
Root Cause
Both encoder classes trust caller-supplied strings and byte arrays without character allowlisting or length reconciliation. The SOCKS4 userid field is null-terminated on the wire, so a caller-supplied null byte silently truncates the value. SOCKS5 authentication frames use length-prefixed strings, but embedded CRLF or null bytes still alter downstream parsing when proxies or logging systems treat those bytes as delimiters.
Attack Vector
Exploitation requires an attacker to influence the domain, userid, username, or password fields passed to a Netty SOCKS client. This commonly occurs when applications proxy user-controlled URLs or credentials through Netty. The attacker submits a value containing \0, \r, or \n bytes. Netty forwards the payload unmodified, and the SOCKS proxy resolves the truncated or spoofed target. The result is a request routed to an attacker-chosen host while logs and upstream validation reflect the original expected value.
See the GitHub Security Advisory GHSA-cc6x-ffm5-83wf and the VulnCheck Advisory for encoder-level details.
Detection Methods for CVE-2026-62380
Indicators of Compromise
- SOCKS4 or SOCKS5 client requests containing 0x00, 0x0D, or 0x0A bytes inside domain, userid, username, or password fields.
- Mismatch between the destination host recorded in application logs and the host resolved by the SOCKS proxy.
- Outbound proxied connections to domains not present in application allowlists but derived from truncated user input.
Detection Strategies
- Inventory Java applications for io.netty:netty-codec-socks versions at or below 4.2.16.Final and 4.1.136.Final using software composition analysis.
- Inspect network telemetry for SOCKS handshake payloads that contain control characters within variable-length fields.
- Correlate application-layer destination fields with proxy-layer resolved destinations to surface truncation events.
Monitoring Recommendations
- Enable byte-level logging on SOCKS proxies and alert on non-printable characters in domain and auth fields.
- Track dependency updates for Netty across build pipelines and container images.
- Route SOCKS proxy access logs into a centralized data lake for retrospective hunting once patched versions are identified.
How to Mitigate CVE-2026-62380
Immediate Actions Required
- Upgrade io.netty:netty-codec-socks to 4.2.17.Final or 4.1.137.Final across all applications and container images.
- Audit application code that constructs Socks4CommandRequest, Socks5CommandRequest, and SOCKS5 password auth messages for untrusted input.
- Reject or sanitize any user-supplied SOCKS field values that contain null bytes or CRLF characters at the application layer.
Patch Information
Netty maintainers released fixes in versions 4.2.17.Final and 4.1.137.Final. The patched encoders validate that domain, userid, username, and password fields do not contain null bytes or CRLF characters, throwing an exception when invalid input is supplied. Refer to the GitHub Security Advisory GHSA-cc6x-ffm5-83wf for the full changeset.
Workarounds
- Wrap SOCKS request construction with input validation that rejects \0, \r, and \n in all caller-supplied fields.
- Disable SOCKS proxy features that accept user-controlled destinations or credentials until the library upgrade is deployed.
- Restrict outbound SOCKS proxy egress with allowlists on the proxy tier so truncated domains cannot resolve to attacker infrastructure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
