CVE-2026-62380
CVE-2026-62380 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3. The underlying weakness is classified as CWE-626.
Key facts
- Severity: Medium (CVSS 4.0 base score 6.3)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-626
- Published:
- Last modified:
Description
Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.
Frequently asked questions
- What is CVE-2026-62380?
- Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.
- How severe is CVE-2026-62380?
- CVE-2026-62380 has a CVSS 4.0 base score of 6.3, rated medium severity.
- Is CVE-2026-62380 being actively exploited?
- It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
- How do I fix CVE-2026-62380?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-62380 published?
- CVE-2026-62380 was published on 2026-08-22.
References
- https://github.com/netty/netty/security/advisories/GHSA-cc6x-ffm5-83wf
- https://www.vulncheck.com/advisories/netty-before-final-socks-proxy-null-byte-injection
Other CWE-626 vulnerabilities
- CVE-2019-11936 — Critical (CVSS 9.8): Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue…
- CVE-2019-17137 — Critical (CVSS 9.4): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR…
- CVE-2020-10773 — Medium (CVSS 4.4): A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it…