THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-8c42-7qj2-3j46 (medium) — Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

[GHSA] GHSA-8c42-7qj2-3j46 (medium) — Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

medgithub_advisoriesPublished 2026-08-17

GHSA-8c42-7qj2-3j46 Severity: medium CVE: CVE-2026-59903

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

### Summary Netty's `CorsHandler` silently overwrites existing `Vary` headers, enabling cache poisoning and sensitive information disclosure.

### Details `io.netty.handler.codec.http.cors.CorsHandler#setVaryHeader` overwrites any existing Vary he

Indicators of compromise

Original source: https://github.com/advisories/GHSA-8c42-7qj2-3j46