CVE-2026-59903: Cache Poisoning and Information Disclosure via CorsHandler Vary Header Overwrite

Vulnerability ID: CVE-2026-59903
CVSS Score: 6.5
Published: 2026-08-17

A technical analysis of CVE-2026-59903 in Netty's HTTP CORS handler, where the CorsHandler overwrites existing application Vary headers with Origin, leading to unauthorized caching of sensitive information.

TL;DR

Netty's CorsHandler replaces application-defined Vary headers with Origin, allowing downstream caching proxies to cache private user sessions and expose them to unauthorized clients.

Technical Details

CWE ID: CWE-524
Attack Vector: Network
Attack Complexity: High
CVSS Score: 6.5
Exploit Status: None
Impact: Information Disclosure / Confidentiality (High)

Affected Systems

Netty Http Codec
Applications utilizing io.netty:netty-codec-http and CorsHandler
netty-codec-http: < 4.1.137.Final (Fixed in: 4.1.137.Final)
netty-codec-http: >= 4.2.0.Final, < 4.2.17.Final (Fixed in: 4.2.17.Final)

Code Analysis

Commit: a68d0ee

Fix CorsHandler setVaryHeader replacing instead of appending

@@ -193,7 +193,9 @@
- response.headers().set(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);
+ if (!response.headers().containsValue(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN, true)) {
+     response.headers().add(HttpHeaderNames.VARY, HttpHeaderNames.ORIGIN);
+ }

Mitigation Strategies

Upgrade Netty dependencies to safe versions.
Deploy virtual patching at CDN or reverse proxy level.
Implement a custom downstream Netty handler to restore critical Vary values.

Remediation Steps:

Identify any usage of CorsHandler in the Netty channel pipeline.
Update maven or gradle build files to pull io.netty:netty-codec-http version 4.1.137.Final or 4.2.17.Final.
Verify that outbound responses retain original Vary values such as Authorization or Cookie alongside Origin.