GHSA-6cqp-g7gg-8hr5

Dashboard / Vulnerabilities / GHSA-6cqp-g7gg-8hr5

GHSA-6cqp-g7gg-8hr5

Summary: Netty: Security Control Bypass via CORS Short-Circuit Failure

Details: ### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an `Origin: null` header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. ### Details In `io.netty.handler.codec.http.cors.CorsHandler#channelRead`, the short-circuit logic relies on the configuration returned by `getForOrigin(origin)` to determine if an origin is authorized. If `getForOrigin` returns a configuration object, the short-circuit check `(!(origin == null || config != null))` is bypassed, and the request proceeds to the backend. The vulnerability is located in the `getForOrigin` method: ```java if (corsConfig.isNullOriginAllowed() || NULL_ORIGIN.equals(requestOrigin)) { return corsConfig; } ``` If an attacker sends `Origin: null`, `NULL_ORIGIN.equals(requestOrigin)` evaluates to true. The method returns the configuration object regardless of whether `isNullOriginAllowed()` was configured by the developer. The short-circuit is bypassed. ### Impact Applications relying on CorsHandler's short-circuit feature to prevent unauthorized cross-origin requests from reaching their backend logic are completely exposed. The framework fails to enforce the developer's intended access controls, allowing unauthorized requests to be processed.

References: https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5, https://nvd.nist.gov/vuln/detail/CVE-2026-56746, https://github.com/netty/netty, https://github.com/netty/netty/releases/tag/netty-4.1.136.Final, https://github.com/netty/netty/releases/tag/netty-4.2.16.Final