Executive brief
Netty is a popular Java networking library used in many applications to handle network communication and data proxying. The SOCKS proxy encoders in versions 4.1.x through 4.1.136.Final and 4.2.0.Final through 4.2.16.Final fail to validate domain names and authentication credentials, allowing attackers who can control these inputs to inject null bytes or carriage-return/line-feed characters. This can lead to domain spoofing attacks, authentication bypass, or protocol confusion that redirects traffic to unintended destinations.
Technical details
The vulnerability is an input validation flaw (CWE-626: Null Byte Interaction Error, CWE-20: Improper Input Validation) in the Socks4ClientEncoder and Socks5ClientEncoder classes within the io.netty.handler.codec.socksx module. The encoders accept null bytes and CRLF characters in domain address and authentication credential fields without sanitization. In SOCKS5, embedded null bytes in domain names cause different proxy implementations to truncate at the null byte, enabling domain spoofing. In SOCKS5 authentication, null bytes and CRLF in username/password fields truncate credentials, potentially matching different accounts. In SOCKS4, embedded null bytes in the userid field create ambiguous null-terminated strings, and in SOCKS4a, null bytes in the domain field cause truncation. An attacker able to control domain or credential inputs (no authentication or special privileges required) can exploit this over the network. Patches are available in versions 4.2.17.Final and 4.1.137.Final.
Affected products
- Netty Project Netty 4.1.x through 4.1.136.Final, 4.2.0.Final through 4.2.16.Final
Timeline
- 2026-08-22: disclosed