All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-59903
MEDIUMpublished 2026-08-17 18:17 UTC · 15 hours ago · modified 2026-08-17 19:16 UTC
6.5
CVSS / 10
// description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
// weaknesses (CWE)
- CWE-524