cve-2026-62380

MEDIUM CVSS 6.3 nvd

Description

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.

Timeline

Published: 2026-08-22
Last Modified: 2026-10-14

CVSS Details

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE

Affected Products

netty netty

Weaknesses (CWE)

CWE-626

CVSS metrics

Version	Base	Severity	Vector	Exploitability	Impact	Source
4.0	6.3	MEDIUM	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`			disclosure@vulncheck.com
3.1	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`	3.9	3.6	nvd@nist.gov

CPE configurations

CPE	Version range	Vulnerable
`cpe:2.3:a:netty:netty::::::::`	< 4.1.137	yes
`cpe:2.3:a:netty:netty::::::::`	>= 4.2.0, < 4.2.17	yes

NVD metadata

NVD status: Analyzed
Source identifier: disclosure@vulncheck.com

References

https://github.com/netty/netty/security/advisories/GHSA-cc6x-ffm5-83wf Vendor Advisory
https://www.vulncheck.com/advisories/netty-before-final-socks-proxy-null-byte-injection Third Party Advisory

Linked Vulnerabilities

cpuoct2026csaf csaf_oracle

{
  "cvss": 6.3,
  "datePublished": "2026-08-22T13:16:39.830",
  "dateUpdated": "2026-10-14T19:10:00.297",
  "description": "Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.",
  "id": "CVE-2026-62380",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "packageURL": "pkg:maven/io.netty/netty-codec-socks",
            "product": "netty",
            "vendor": "netty",
            "versions": [
              {
                "lessThan": "4.2.16.Final",
                "status": "affected",
                "version": "4.2.0.Final",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "4.2.16.Final",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "packageURL": "pkg:maven/io.netty/netty-codec-socks",
            "product": "netty",
            "vendor": "netty",
            "versions": [
              {
                "lessThan": "4.1.137.Final",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "4.1.137.Final",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "disclosure@vulncheck.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "C2D95C1D-B022-435F-B4C7-33FC460064EA",
                "versionEndExcluding": "4.1.137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "80E3B839-CD5C-45D0-81C0-CABCE7A5D9AF",
                "versionEndExcluding": "4.2.17",
                "versionStartIncluding": "4.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final."
      },
      {
        "lang": "es",
        "value": "Netty (io.netty:netty-codec-socks) versiones 4.2.0.Final hasta 4.2.16.Final y 4.1.x hasta 4.1.136.Final contienen vulnerabilidades de inyección de byte nulo, CRLF y credenciales en los codificadores de cliente SOCKS4 (Socks4ClientEncoder) y SOCKS5 (Socks5ClientEncoder), que no validan los campos de dirección de dominio y autenticación (nombre de usuario/contraseña). Un atacante capaz de controlar estos campos puede inyectar bytes nulos o caracteres CRLF para truncar o alterar valores, lo que podría permitir la suplantación de dominio, el truncamiento de ID de usuario SOCKS4, la inyección de datos de autenticación y la confusión de protocolo. Corregido en 4.2.17.Final y 4.1.137.Final."
      }
    ],
    "id": "CVE-2026-62380",
    "lastModified": "2026-10-14T19:10:00.297",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "disclosure@vulncheck.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-62380",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-26T15:55:28.591533Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-22T13:16:39.830",
    "references": [
      {
        "source": "disclosure@vulncheck.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/netty/netty/security/advisories/GHSA-cc6x-ffm5-83wf"
      },
      {
        "source": "disclosure@vulncheck.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.vulncheck.com/advisories/netty-before-final-socks-proxy-null-byte-injection"
      }
    ],
    "sourceIdentifier": "disclosure@vulncheck.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-626"
          }
        ],
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "MEDIUM",
  "source": "nvd",
  "title": "Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain ..."
}

View JSON API Download JSON

cve-2026-62380

Raw JSON Data