CVE-2026-59903

A flaw was found in Netty, an asynchronous, event-driven network application framework. The CorsHandler component incorrectly replaces application Vary headers, such as Authorization or Cookie, with Origin. This allows a caching proxy or Content Delivery Network (CDN) to reuse authenticated responses across different users, leading to the disclosure of sensitive information.

This Moderate impact information disclosure flaw in Netty arises from the CorsHandler incorrectly overwriting application Vary headers with Origin. This could allow caching proxies or CDNs to reuse authenticated responses across different users, potentially exposing sensitive data. Exploitation requires the presence of a caching proxy or CDN in front of the affected Netty application.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.