CVE-2026-56746— Netty 权限许可和访问控制问题漏洞

Netty has a Security Control Bypass via CORS Short-Circuit Failure

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

访问控制不恰当

Netty 权限许可和访问控制问题漏洞

Netty是Netty团队开源的一款非阻塞I/O客户端-服务器框架,它主要用于开发Java网络应用程序,如协议服务器和客户端等。 Netty 4.2.0.Final至4.2.15.Final版本和4.1.0.Final至4.1.135.Final版本存在权限许可和访问控制问题漏洞，该漏洞源于起源评估过程中的逻辑运算符错误，可能导致攻击者发送Origin:null标头的请求绕过CorsHandler的短路机制，将未经授权的请求转发到后端应用程序，绕过预期的访问控制。

N/A

N/A