Vulnerabilities ›

CVE-2026-42578

High ⚡ Exploit Available

CWE-113 — Weakness Type

                    Published: May 13, 2026                      ·  Modified: May 20, 2026                      ·  Source: NVD                

CVSS v3

7.5

🔗 NVD Official

📄 Description (English)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

🤖 AI Executive Summary

Netty's HttpProxyHandler constructs HTTP CONNECT requests with disabled header validation, allowing attackers to inject arbitrary HTTP headers into proxy requests. This vulnerability affects versions prior to 4.2.13.Final and 4.1.133.Final.

📄 Description (Arabic)

يسمح الضعف في معالج وكيل HTTP بحقن رؤوس HTTP تعسفية من خلال تعطيل التحقق من الصحة في طلبات CONNECT. يمكن للمهاجمين الذين يمكنهم التأثير على رؤوس الخروج استغلال هذا لتعديل طلبات الوكيل وتجاوز الضوابط الأمنية.

🤖 ملخص تنفيذي (AI)

🤖 AI Intelligence Analysis Analyzed: May 20, 2026 12:41

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

banking telecom government energy

🎯 MITRE ATT&CK Techniques

T1190 T1498 T1021

⚖️ Saudi Risk Score (AI)

7.0

/ 10.0

🔧 Remediation Steps (English)

Upgrade Netty to version 4.2.13.Final or 4.1.133.Final or later. Implement input validation for outbound headers before passing to HttpProxyHandler. Review and restrict which components can influence outbound headers in proxy configurations.

🔧 خطوات المعالجة (العربية)

قم بترقية Netty إلى الإصدار 4.2.13.Final أو 4.1.133.Final أو أحدث. قم بتنفيذ التحقق من صحة المدخلات لرؤوس الخروج قبل تمريرها إلى HttpProxyHandler. راجع وقيد المكونات التي يمكنها التأثير على رؤوس الخروج في تكوينات الوكيل.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

A.13.1.1 A.14.2.1

🔵 SAMA CSF

ID.AM-2 PR.DS-1 PR.IP-1

🟡 ISO 27001:2022

A.12.6.1 A.14.2.1

🔗 References & Sources 2

🔗

https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr

security-advisories@github.com

Exploit Mitigation Vendor Advisory

🔗

https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr

134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit Mitigation Vendor Advisory

📦 Affected Products / CPE 2 entries

netty:netty

📊 CVSS Score

7.5

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityN — None / Network

IntegrityH — High

AvailabilityN — None / Network

📋 Quick Facts

Severity High

CVSS Score7.5

CWECWE-113

EPSS0.03%

Exploit ✓ Yes

Patch ✗ No

Published 2026-05-13

Source Feed nvd

🇸🇦 Saudi Risk Score

7.0

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

exploit-available CWE-113

🏢 Vendor Advisories

🔗 https://github.com/netty/netty/security/advisories/G... 🔗 https://github.com/netty/netty/security/advisories/G...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-42578

Introduce Yourself

Sign In Required