redhat/netty vulnerabilities

Latest redhat/netty CVEs

Newest publication first

1. CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

   Published 2026-08-17

   High·CVSS 7.5 EPSS 0.32%

   Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.