CyberRota Analysis
AI-GeneratedThe vulnerability in Netty allows the CorsHandler to improperly replace critical application Vary headers, such as Authorization or Cookie, with the Origin header, potentially enabling caching proxies or CDNs to serve authenticated responses to unauthorized users. This could lead to the unintended disclosure of sensitive information. Organizations using affected versions of Netty should prioritize upgrading to versions 4.1.137.Final or 4.2.17.Final to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.