Listen to this Post
How CVE-2026-59921 Works
Netty is an asynchronous, event-driven network application framework widely used in Java-based web services and microservices. The `HttpPostRequestEncoder` component is responsible for constructing multipart HTTP request bodies (e.g., file uploads with multipart/form-data). Prior to versions 4.1.136.Final and 4.2.16.Final, this encoder builds `Content-Disposition` MIME headers by directly concatenating user-supplied filenames and field names into the header string without any validation or sanitization of CRLF characters (\r\n).
Since MIME headers are delimited by CRLF sequences, an attacker who controls the filename parameter can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the `FileUpload` implementations’ `setFilename()` methods — which only perform null checks — neutralize CRLF characters before the filename is embedded into the header.
When a filename containing `\r\n` is supplied, the attacker can append new MIME headers, override the Content-Type, inject a new `boundary` identifier, or attach arbitrary HTML/script content. This enables MIME header injection, `Content-Type` spoofing, and stored XSS risks. The vulnerability is classified under CWE-93 (Improper Neutralization of CRLF Sequences) and carries a CVSS 3.1 base score of 5.7 (Medium) with the vector AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The attack requires adjacent network access, low privileges, and no user interaction, with a high integrity impact but no confidentiality or availability impact.
The fix introduces a new `FileUploadUtil.validateFileNameForMultiPart()` utility method that validates each character, rejecting control characters below 0x20, DEL (0x7F), double quotes, and backslashes. `DiskFileUpload` and `MemoryFileUpload` now call this validation method in setFilename(), and `HttpPostMultipartRequestDecoder.cleanString` strips double quotes and backslashes while replacing control characters with spaces.
DailyCVE Form
Platform: Netty
Version: <4.1.136.Final, <4.2.16.Final
Vulnerability: CRLF Injection
Severity: Medium (CVSS 5.7)
Date: 2026-07-28
Prediction: Patch expected 2026-08-15
What Undercode Say
Analytics:
- EPSS Score: 0.00281 (0.281% probability of exploitation in the wild)
- Exploit Maturity: Proof-of-concept available
- Attack Vector: Adjacent network
- Privileges Required: Low
- User Interaction: None
- Integrity Impact: High
- CWE: CWE-93 (CRLF Injection)
- GitHub Advisory: GHSA-gcjf-9mgh-3p7g
Vulnerable Code Snippet (Before Patch):
// HttpPostRequestEncoder - vulnerable concatenation String contentDisposition = "Content-Disposition: form-data; name=\"" + name + "\"; filename=\"" + filename + "\"\r\n"; // No CRLF sanitization - attacker can inject \r\n in filename
Patch Validation Logic (After Patch):
// FileUploadUtil.validateFileNameForMultiPart()
public static void validateFileNameForMultiPart(String filename) {
for (char c : filename.toCharArray()) {
if (c < 0x20 || c == 0x7F || c == '"' || c == '\') {
throw new IllegalArgumentException("Invalid filename character: " + c);
}
}
}
Exploit
An attacker can craft a malicious filename containing CRLF sequences to inject arbitrary MIME headers into a multipart request:
Example malicious filename payload filename="malicious.txt\r\nContent-Type: application/xss\r\nX-Injected: true\r\n" Resulting injected MIME headers in multipart body: Content-Disposition: form-data; name="file"; filename="malicious.txt" Content-Type: application/xss X-Injected: true
This allows the attacker to override the `Content-Type` header of the part, inject additional headers, or manipulate the `boundary` delimiter to confuse downstream parsers. The attack is only exploitable if the application uses the multipart encoder with filenames derived from user-controlled input and does not perform its own CRLF sanitization.
Protection
- Upgrade Netty to versions 4.1.136.Final or 4.2.16.Final or later.
2. Maven dependency update:
<dependency> <groupId>io.netty</groupId> <artifactId>netty-codec-http</artifactId> <version>4.1.136.Final</version> </dependency>
or for 4.2.x:
<dependency> <groupId>io.netty</groupId> <artifactId>netty-codec-http</artifactId> <version>4.2.16.Final</version> </dependency>
3. Application-layer input validation: Sanitize all user-supplied filenames before passing them to HttpPostRequestEncoder, rejecting or escaping CRLF characters.
4. Implement a custom `FileUpload` wrapper that overrides `setFilename()` to perform CRLF sanitization if an immediate upgrade is not possible.
5. Monitor logs for anomalous `Content-Disposition` headers containing `\r\n` sequences.
Impact
- Header Injection: Attackers can inject arbitrary MIME headers into multipart request bodies.
- Content-Type Spoofing: Override the `Content-Type` of uploaded files, potentially leading to MIME type confusion and stored XSS.
- Boundary Manipulation: Inject new `boundary` identifiers to alter how multipart requests are parsed.
- Downstream Service Manipulation: Alter form data or inject malicious scripts processed by middleware, storage layers, or backend services.
- Limited Practical Impact: Exploitation is constrained by deployment context and requires the attacker to control the filename input.
- No Confidentiality or Availability Impact: The vulnerability affects integrity only (CVSS 5.7).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
