Skip to content
VulniPulse
Sign in
Advisory severityHigh7.5Red Hat Linux

High [CVE-2026-56746] Security control bypass allows unauthorized requests via null origin header

This high-severity Red Hat Linux advisory covers CVE-2026-56746 affecting Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat build of Quarkus 3.27.4.SP3.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-56746 Source published Source updated

VulniPulse record published Record updated

CVE-2026-56746
Affected products & platforms
Red Hat LinuxUnclassified
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process.

CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed.

An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls.

This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. This could lead to a compromise of data integrity by allowing unauthorized actions.

Red Hat ships Netty's netty-codec-http component in multiple products. Upgrade to Netty 4.1.136.Final or 4.2.16.Final to resolve this issue.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-807.

Affected versions
  • 4.2.0
  • 4.2.15
  • 4.1.0
  • 4.1.135

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Fixed versions
  • 4.1.136
  • 4.2.16
  • netty-codec-http
  • devspaces/openvsx-rhel9:1787759145
  • devspaces/pluginregistry-rhel9:1787759723
  • RHSA-2026:54622
  • RHSA-2026:48118
  • RHSA-2026:47189
  • RHSA-2026:47172
  • RHSA-2026:54435
  • RHSA-2026:62260

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • If CORS short-circuit functionality is not required, disable the shortCircuit() configuration in the CorsHandler. Alternatively, implement application-level origin validation to reject requests with null Origin headers. A web application firewall (WAF) can also be configured to block requests with null or missing Origin headers.

Official advisory · high-confidence parse· fetched 12 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.