CVE-2026-62380

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/netty/netty/security/advisories/GHSA-cc6x-ffm5-83wf	Vendor Advisory
https://www.vulncheck.com/advisories/netty-before-final-socks-proxy-null-byte-injection	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:netty:netty::::::::
	cpe:2.3:a:netty:netty::::::::

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Netty (io.netty:netty-codec-socks) versiones 4.2.0.Final hasta 4.2.16.Final y 4.1.x hasta 4.1.136.Final contienen vulnerabilidades de inyección de byte nulo, CRLF y credenciales en los codificadores de cliente SOCKS4 (Socks4ClientEncoder) y SOCKS5 (Socks5ClientEncoder), que no validan los campos de dirección de dominio y autenticación (nombre de usuario/contraseña). Un atacante capaz de controlar estos campos puede inyectar bytes nulos o caracteres CRLF para truncar o alterar valores, lo que podría permitir la suplantación de dominio, el truncamiento de ID de usuario SOCKS4, la inyección de datos de autenticación y la confusión de protocolo. Corregido en 4.2.17.Final y 4.1.137.Final.

Information

Published : 2026-08-22 13:16

Updated : 2026-10-14 19:10

NVD link : CVE-2026-62380

Mitre link : CVE-2026-62380

CVE.ORG link : CVE-2026-62380

JSON object : View

Products Affected

netty

netty

CWE

CWE-626

Null Byte Interaction Error (Poison Null Byte)

{"id": "CVE-2026-62380", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62380", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T15:55:28.591533Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "netty", "product": "netty", "versions": [{"status": "affected", "version": "4.2.0.Final", "lessThan": "4.2.16.Final", "versionType": "custom"}, {"status": "unaffected", "version": "4.2.16.Final", "versionType": "custom"}], "packageURL": "pkg:maven/io.netty/netty-codec-socks", "defaultStatus": "unaffected"}, {"vendor": "netty", "product": "netty", "versions": [{"status": "affected", "version": "0", "lessThan": "4.1.137.Final", "versionType": "custom"}, {"status": "unaffected", "version": "4.1.137.Final", "versionType": "custom"}], "packageURL": "pkg:maven/io.netty/netty-codec-socks", "defaultStatus": "unaffected"}]}], "published": "2026-08-22T13:16:39.830", "references": [{"url": "https://github.com/netty/netty/security/advisories/GHSA-cc6x-ffm5-83wf", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/netty-before-final-socks-proxy-null-byte-injection", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-626"}]}], "descriptions": [{"lang": "en", "value": "Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final."}, {"lang": "es", "value": "Netty (io.netty:netty-codec-socks) versiones 4.2.0.Final hasta 4.2.16.Final y 4.1.x hasta 4.1.136.Final contienen vulnerabilidades de inyecci\u00f3n de byte nulo, CRLF y credenciales en los codificadores de cliente SOCKS4 (Socks4ClientEncoder) y SOCKS5 (Socks5ClientEncoder), que no validan los campos de direcci\u00f3n de dominio y autenticaci\u00f3n (nombre de usuario/contrase\u00f1a). Un atacante capaz de controlar estos campos puede inyectar bytes nulos o caracteres CRLF para truncar o alterar valores, lo que podr\u00eda permitir la suplantaci\u00f3n de dominio, el truncamiento de ID de usuario SOCKS4, la inyecci\u00f3n de datos de autenticaci\u00f3n y la confusi\u00f3n de protocolo. Corregido en 4.2.17.Final y 4.1.137.Final."}], "lastModified": "2026-10-14T19:10:00.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2D95C1D-B022-435F-B4C7-33FC460064EA", "versionEndExcluding": "4.1.137"}, {"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E3B839-CD5C-45D0-81C0-CABCE7A5D9AF", "versionEndExcluding": "4.2.17", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}