THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-59921 (MEDIUM 5.7) — Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME

[NVD] CVE-2026-59921 (MEDIUM 5.7) — Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME

mednvdPublished 2026-07-28

CVE-2026-59921 CVSS: 5.7 MEDIUM Published: 2026-07-28T23:17:09.923

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF charac

Indicators of compromise

CVE-2026-59921cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-59921