CVE-2026-59921: Netty CRLF injection in HttpPostRequestEncoder multipart filenames

CVE-2026-59921 · Severity: medium · CVSS 5.7 · Published 2026-07-28

Netty is a widely used networking framework that helps developers build high-performance web applications and services. A security flaw in its HTTP request handling allows attackers to inject malicious data into file upload requests by using specially crafted filenames containing hidden line-break characters. This could allow an attacker to bypass security filters, perform unauthorized actions on downstream systems, or deliver malicious scripts (XSS) that compromise user sessions.

Technologies: io.netty:netty-codec-http (Maven), Netty Project Netty codec-http. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-59921 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59921 being exploited in the wild.
How severe is CVE-2026-59921?
Medium severity, with a CVSS score of 5.7, published 28 July 2026.
Which products and versions are affected?
io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.
Is there a fix for CVE-2026-59921?
Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59921 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59921?
Check whether you run io.netty:netty-codec-http (Maven) or Netty Project Netty codec-http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later
    # set io.netty:netty-codec-http to 4.2.16.Final in your pom.xml or build.gradle

Technical details

A CRLF injection vulnerability exists in Netty's `HttpPostRequestEncoder` and `FileUpload` implementations (including `DiskFileUpload`, `MemoryFileUpload`, and `MixedFileUpload`). The root cause is the direct concatenation of user-supplied filenames and field names into `Content-Disposition` MIME headers without sanitizing carriage return (\r) or line feed (\n) characters. An attacker who can control the filename of an uploaded file can inject arbitrary MIME headers, override Content-Type values, or manipulate multipart boundaries. This can lead to Cross-Site Scripting (XSS), security bypasses in downstream middleware, or request smuggling within the multipart body. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final by adding validation to the `setFilename()` and encoder methods.

Affected products

  • Netty netty-codec-http < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final

Identifiers

  • CVE-2026-59921
  • GHSA-gcjf-9mgh-3p7g

Timeline

  • 2026-07-14: advisory: GitHub Security Advisory published
  • 2026-07-28: disclosed: NVD publication date
  • 2026-07-28: patched: Fixes released in 4.1.136.Final and 4.2.16.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.