xiaoqiMikko/netty-http-check

PoC

CVE-2026-59903 / CVE-2026-33870: offline checker for io.netty:netty-codec-http - its 14 CVEs plus 9 advisories Netty published on 2026-09-10 that the GitHub Advisory Database (Dependabot) does not list. 4.1.137.Final / 4.2.17.Final is no longer enough; upgrade to 4.1.138.Final / 4.2.18.Final.

view exploit source poc_in_githubauthor xiaoqiMikkopublished 2026-09-08catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-59903US	high7.5	0.32% (25th)	Exploit	2026-08-17
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces a…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan