2.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42578

CVE-2026-42578: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42578

CVE-2026-42578:

2.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-handler-proxy	maven	<= 4.1.132.Final	4.1.133.Final
io.netty:netty-handler-proxy	maven	>= 4.2.0.Alpha1, <= 4.2.12.Final	4.2.13.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of HTTP Header Injection (CWE-113) within Netty's HttpProxyHandler. The root cause is that the newInitialMessage method, which creates the HTTP CONNECT request for proxying, explicitly disabled validation for HTTP headers. This was done via the line DefaultHttpHeadersFactory.headersFactory().withValidation(false). Because of this, any custom headers (outboundHeaders) passed to the HttpProxyHandler constructor were not sanitized for Carriage Return (CR) and Line Feed (LF) characters. An attacker able to control the values of these headers could inject new, arbitrary headers into the CONNECT request sent to the proxy server. This could lead to various attacks, such as bypassing proxy authentication or smuggling requests. The patch rectifies this by making header validation the default behavior. It introduces a new boolean field, validateInitialHeaders, which is set to true by default in the constructors. This field is then used in newInitialMessage to conditionally enable or disable validation, effectively closing the security gap while maintaining an option for the old, unsafe behavior if explicitly requested.

Vulnerable functions

io.netty.handler.proxy.HttpProxyHandler.newInitialMessage

handler-proxy/src/main/java/io/netty/handler/proxy/HttpProxyHandler.java

This function constructs the initial HTTP CONNECT request. In vulnerable versions, it explicitly disabled header validation by calling `DefaultHttpHeadersFactory.headersFactory().withValidation(false)`. This allows user-provided headers (`outboundHeaders`) containing CRLF characters to be added to the request, leading to HTTP Header Injection. The patch changes this to use a new `validateInitialHeaders` field, which is true by default, thus enabling validation.

io.netty.handler.proxy.HttpProxyHandler.HttpProxyHandler

handler-proxy/src/main/java/io/netty/handler/proxy/HttpProxyHandler.java

The constructors of `HttpProxyHandler` are the entry point for the vulnerability. They accept user-provided `HttpHeaders` (`outboundHeaders`) which can contain malicious CRLF sequences. While the injection happens in `newInitialMessage`, the constructors are where the tainted data is introduced into the handler. The patch adds a `validateInitialHeaders` parameter to the constructors to control the validation behavior, making the secure option the default.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.