CVE-2026-59903: netty

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2026-59903DEBIAN-CVE-2026-59903CGA-2378-p2jh-552c+1407 more

Published 17-08-2026Last modified 17-08-2026

Vulnerability summary

CVE-2026-59903 is a high (CVSS 7.5) vulnerability in netty. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 14.7% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

0.25%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3

OPENSUSE-SU-2026:11882-1 SUSE-SU-2026:4391-1 CGA-JRMR-PVJW-RMXV

Timeline

17-08-2026
PublishedVulnerability first disclosed.
17-08-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-524Use of Cache Containing Sensitive InformationThe code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Affected systems

Chainguard200 products

airbyte-platform-bootloader< 2.0.0-r4
airbyte-platform-cron< 2.0.0-r4
airbyte-platform-fips-bootloader< 2.0.0-r4
airbyte-platform-fips-cron< 2.0.0-r4
airbyte-platform-fips-server< 2.0.0-r4

airbyte-platform-fips-workers< 2.0.0-r4
airbyte-platform-fips-workload-api-server< 2.0.0-r4
airbyte-platform-fips-workload-launcher< 2.0.0-r4
airbyte-platform-server< 2.0.0-r4
airbyte-platform-workers< 2.0.0-r4
airbyte-platform-workload-api-server< 2.0.0-r4
airbyte-platform-workload-launcher< 2.0.0-r4
airbyte-server< 2.0.0-r13
airbyte-server-fips< 2.0.0-r14
akhq< 0.28.0-r7
apache-activemq-artemis< 2.55.0-r4
apache-activemq-artemis-fips< 2.55.0-r2
apache-camel-karavan-devmode< 4.18.1-r11
apache-hop< 2.19.0-r2
apache-hop-fips< 2.19.0-r1
apache-nifi-2.11< 2.11.0-r4
apache-polaris< 1.7.0-r3
apache-polaris-fips< 1.7.0-r3
apache-pulsar-4.0< 4.0.13-r2
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.4-r2
apache-pulsar-fips-4.0< 4.0.13-r1
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.4-r2
apicurio-registry< 3.3.1-r7
apicurio-registry-3-operator< 3.3.1-r7
apicurio-registry-3-operator-fips< 3.3.1-r6
apicurio-registry-fips< 3.3.1-r6
camunda-8.8< 8.8.35-r2
camunda-8.9< 8.9.16-r1
camunda-zeebe-8.6< 8.6.39-r10
camunda-zeebe-8.7< 8.7.37-r2
camunda-zeebe-8.8< 8.8.36-r1
camunda-zeebe-8.9< 8.9.16-r1
celeborn-0.5All versions (No fix recorded) | < 0.5.4-r35
celeborn-0.6All versions (No fix recorded) | < 0.6.3-r16
celeborn-0.7All versions (No fix recorded) | < 0.7.0-r13
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.22-r0
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.8-r0
commercial-elasticsearch-9.5< 9.5.5-r0
conductor< 3.32.1-r2
conductor-fips< 3.32.1-r2
cruise-control-fips-jars< 2.5.146-r4
cruise-control-jars< 2.5.146-r3
druid< 37.0.0-r53 | < 37.0.0-r56
elasticsearch-8.19< 8.19.20-r1
elasticsearch-8.19-iamguarded< 8.19.20-r1
elasticsearch-8.19-iamguarded-fips< 8.19.20-r2
elasticsearch-9.2< 9.2.8-r12
elasticsearch-9.2-iamguarded< 9.2.8-r12
elasticsearch-9.2-iamguarded-fips< 9.2.8-r12
elasticsearch-9.3< 9.3.8-r5
elasticsearch-9.3-iamguarded< 9.3.8-r5
elasticsearch-9.3-iamguarded-fips< 9.3.7-r9
elasticsearch-9.4< 9.4.5-r2
elasticsearch-9.4-iamguarded< 9.4.5-r2
elasticsearch-9.4-iamguarded-fips< 9.4.5-r3
elasticsearch-9.5< 9.5.2-r1
elasticsearch-9.5-iamguarded< 9.5.2-r1
elasticsearch-9.5-iamguarded-fips< 9.5.2-r3
elasticsearch-fips-8.19< 8.19.20-r2
elasticsearch-fips-9.2< 9.2.8-r12
elasticsearch-fips-9.3< 9.3.7-r9
elasticsearch-fips-9.4< 9.4.5-r3
elasticsearch-fips-9.5< 9.5.2-r3
floci< 1.7.0-r1
floci-az< 0.11.0-r1
flyway< 13.6.0-r2 | < 13.3.0-r1
flyway-fips< 13.3.0-r1
gremlin-server< 3.8.1-r3
grpc-java-fips-1.56.0-m2< 1.56.0-r8
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r14 | All versions (No fix recorded) | < 3.5.0-r3
hono-adapter-mqtt< 2.7.0-r38
hono-cli< 2.7.0-r38
hono-service-auth< 2.7.0-r38
hono-service-command-router< 2.7.0-r38
hono-service-device-registry-jdbc< 2.7.0-r38
infinispan-15.0< 15.0.22-r17
infinispan-15.1< 15.1.7-r28
infinispan-15.2< 15.2.6-r26
infinispan-16.0< 16.0.14-r4
infinispan-16.1< 16.1.4-r11
infinispan-16.2< 16.2.2-r3
kafbat-ui< 1.5.0-r14
kafbat-ui-fips< 1.5.0-r7
kafka_exporter-strimzi-compat< 1.2.0-r4 | < 1.2.0-r5
kafka-bridge< 1.1.0-r2
kafka-bridge-fips< 1.1.0-r3
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.2< 2025.2.4-r8
kayenta-2025.4All versions (No fix recorded)
kayenta-2026.0< 2026.0.7-r3
kayenta-2026.1< 2026.1.2-r4
kayenta-fips-2025.2< 2025.2.4-r8
kayenta-fips-2025.4< 2025.4.6-r7
kayenta-fips-2026.0< 2026.0.5-r2
kayenta-fips-2026.1< 2026.1.2-r4
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.4-r24
keycloak-26.6-iamguarded-compat< 26.6.4-r24
keycloak-26.6-operator< 26.6.4-r24
keycloak-26.7< 26.7.1-r4
keycloak-26.7-iamguarded-compat< 26.7.1-r4
keycloak-26.7-operator< 26.7.1-r4
keycloak-fips-26.5< 26.5.7-r10
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r10
keycloak-fips-26.5-operator< 26.5.7-r10
keycloak-fips-26.6< 26.6.4-r10
keycloak-fips-26.6-iamguarded-fips< 26.6.4-r10
keycloak-fips-26.6-operator< 26.6.4-r10
keycloak-fips-26.7< 26.7.1-r4
keycloak-fips-26.7-iamguarded-fips< 26.7.1-r4
keycloak-fips-26.7-operator< 26.7.1-r4
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r12
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r12
knative-kafka-broker-1.21-dispatcher-loom< 1.21.5-r3
knative-kafka-broker-1.21-receiver-loom< 1.21.5-r3
knative-kafka-broker-1.22-dispatcher-loom< 1.22.3-r7
knative-kafka-broker-1.22-receiver-loom< 1.22.3-r7
knative-kafka-broker-1.23-dispatcher-loom< 1.23.0-r3
knative-kafka-broker-1.23-receiver-loom< 1.23.0-r3
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r10
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r10
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.5-r2
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.5-r2
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.3-r3
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.3-r3
knative-kafka-broker-fips-1.23-dispatcher-loom< 1.23.0-r4
knative-kafka-broker-fips-1.23-receiver-loom< 1.23.0-r4
kserve-modelmesh< 0.12.0-r39
localstack< 4.14.0-r24
logstash-8.19< 8.19.20-r4
logstash-8.19-iamguarded-compat< 8.19.20-r4
logstash-8.19-with-output-opensearch< 8.19.20-r4
logstash-9.2< 9.2.8-r6
logstash-9.2-iamguarded-compat< 9.2.8-r6
logstash-9.2-with-output-opensearch< 9.2.8-r6
logstash-9.3All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded)
logstash-9.4< 9.4.5-r3
logstash-9.4-iamguarded-compat< 9.4.5-r3
logstash-9.5< 9.5.2-r3
logstash-9.5-iamguarded-compat< 9.5.2-r3
logstash-fips-9.4< 9.4.5-r1
logstash-fips-9.4-iamguarded-compat< 9.4.5-r1
logstash-fips-9.5< 9.5.2-r2
logstash-fips-9.5-iamguarded-compat< 9.5.2-r2
management-api-for-apache-cassandra-4.0< 0.1.125-r2
management-api-for-apache-cassandra-4.1< 0.1.124-r1
management-api-for-apache-cassandra-5.0< 0.1.124-r1
metabase< 0.63.15-r1
neo4j-2026.01All versions (No fix recorded)
neo4j-2026.02< 2026.02.3-r4
neo4j-2026.03< 2026.03.1-r4
neo4j-2026.04< 2026.04.0-r3
neo4j-2026.05< 2026.05.0-r12
neo4j-2026.05-docker-publishAll versions (No fix recorded)
neo4j-2026.06< 2026.06.0-r9
neo4j-2026.07< 2026.07.1-r2
neo4j-5.26< 5.26.29-r2
nuxeo-2023< 2023.45-r9
opensearch-2< 2.19.6-r8
opensearch-2-ml-commons< 2.19.6-r8
opensearch-2-performance-analyzer< 2.19.6-r8
opensearch-2-repository-azure< 2.19.6-r8
opensearch-2-repository-s3< 2.19.6-r8
opensearch-2-security< 2.19.6-r8
opensearch-2-transport-nio< 2.19.6-r8
opensearch-3< 3.8.0-r0
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-ml-commons< 3.8.0-r0
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.8.0-r0
opensearch-3-performance-analyzer< 3.8.0-r0
opensearch-3-repository-azure< 3.8.0-r0
opensearch-3-repository-s3< 3.8.0-r0
opensearch-3-security< 3.8.0-r0
opensearch-3-security-analytics< 3.8.0-r2
opensearch-fips-3< 3.8.0-r2
opensearch-fips-3-ml-commons< 3.8.0-r2
opensearch-fips-3-notifications< 3.8.0-r2
opensearch-fips-3-performance-analyzer< 3.8.0-r2
opensearch-fips-3-repository-azure< 3.8.0-r2
opensearch-fips-3-repository-s3< 3.8.0-r2
opensearch-fips-3-security< 3.8.0-r2
opensearch-fips-3-security-analytics< 3.8.0-r2
pinot< 1.5.1-r18

Show all 200

1 vendor · 200 products · Showing 200 of 360. Use Open JSON for the complete list.

References

11 links

github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46X Refsource CONFIRMAdvisoryWEBVendor Advisory
github.com/netty/netty/pull/17213X Refsource MISCFIXWEBIssue TrackingPatch
github.com/netty/netty/pull/17217X Refsource MISCFIXWEBIssue TrackingPatch
github.com/netty/netty/releases/tag/netty-4.1.137.FinalX Refsource MISCWEBRelease Notes
github.com/netty/netty/releases/tag/netty-4.2.17.FinalX Refsource MISCWEBRelease Notes
ubuntu.com/security/CVE-2026-59903REPORT
www.cve.org/CVERecord?id=CVE-2026-59903REPORT
security-tracker.debian.org/tracker/CVE-2026-59903Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59903.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-59903Advisory

Show all 11 references

github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities