Количество 4
Количество 4
CVE-2026-59903
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
CVE-2026-59903
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
CVE-2026-59903
Netty is an asynchronous, event-driven network application framework. ...
GHSA-8c42-7qj2-3j46
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-59903 Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final. | CVSS3: 6.5 | 0% Низкий | 9 дней назад |
 | CVE-2026-59903 Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final. | CVSS3: 6.5 | 0% Низкий | 9 дней назад |
| CVE-2026-59903 Netty is an asynchronous, event-driven network application framework. ... | CVSS3: 6.5 | 0% Низкий | 9 дней назад |
| GHSA-8c42-7qj2-3j46 Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite | CVSS3: 6.5 | 0% Низкий | 9 дней назад |
Уязвимостей на страницу