Detections
Analytics
SCA: security update for io.netty:netty-codec-http (GHSA-gcjf-9mgh-3p7g)
medium Tenable Cloud Security Plugin ID 445169
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and
4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating
user-supplied filenames and field names into Content-Disposition MIME headers without validating or
sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the
filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither
the encoder nor the FileUpload implementations' setFilename() methods, which only check for null,
neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in
versions 4.1.136.Final and 4.2.16.Final. (CVE-2026-59921)
Solution
Update the io.netty:netty-codec-http library and its related packages to version 4.1.136.Final or later.See Also
Plugin Details
Severity: Medium
ID: 445169
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 7/23/2026
Updated: 8/7/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.7
Percentile: 96.31
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N
CVSS Score Source: CVE-2026-59921
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/22/2026
Vulnerability Publication Date: 7/22/2026
Reference Information
CVE: CVE-2026-59921
cwe: CWE-93