{"vulnerability": "CVE-2026-59903", "sightings": [{"uuid": "8f9a95cf-dd94-4b85-8e84-791e85d492c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://gist.github.com/alon710/53c9694ceb5875fbe39960b018952b7c", "content": "# CVE-2026-59903: CVE-2026-59903: Cache Poisoning and Information Disclosure via CorsHandler Vary Header Overwrite\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59903\n\n## Summary\nA technical analysis of CVE-2026-59903 in Netty's HTTP CORS handler, where the CorsHandler overwrites existing application Vary headers with Origin, leading to unauthorized caching of sensitive information.\n\n## TL;DR\nNetty's CorsHandler replaces application-defined Vary headers with Origin, allowing downstream caching proxies to cache private user sessions and expose them to unauthorized clients.\n\n## Technical Details\n\n- **CWE ID**: CWE-524\n- **Attack Vector**: Network\n- **Attack Complexity**: High\n- **CVSS Score**: 6.5\n- **Exploit Status**: None\n- **Impact**: Information Disclosure / Confidentiality (High)\n\n## Affected Systems\n\n- Netty Http Codec\n- Applications utilizing io.netty:netty-codec-http and CorsHandler\n- **netty-codec-http**: < 4.1.137.Final (Fixed in: `4.1.137.Final`)\n- **netty-codec-http**: >= 4.2.0.Final, < 4.2.17.Final (Fixed in: `4.2.17.Final`)\n\n## Mitigation\n\n- Upgrade Netty dependencies to safe versions.\n- Deploy virtual patching at CDN or reverse proxy level.\n- Implement a custom downstream Netty handler to restore critical Vary values.\n\n**Remediation Steps:**\n1. Identify any usage of CorsHandler in the Netty channel pipeline.\n2. Update maven or gradle build files to pull io.netty:netty-codec-http version 4.1.137.Final or 4.2.17.Final.\n3. Verify that outbound responses retain original Vary values such as Authorization or Cookie alongside Origin.\n\n## References\n\n- [GitHub Security Advisory GHSA-8c42-7qj2-3j46](https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46)\n- [Netty Pull Request 17213](https://github.com/netty/netty/pull/17213)\n- [Netty Pull Request 17217](https://github.com/netty/netty/pull/17217)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59903) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-17T19:31:21.730516Z"}, {"uuid": "ac02366f-6ca3-49d0-a4dd-7a61f8470617", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pl5ah2v", "content": "GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-mart-server. This addresses the following vulnerabilities: CVE-2026-55831 CVE-2026-55833 CVE-2026-56745 CVE-2026-56746 CVE-2026-56819 CVE-2026-59898 CVE-2026-59899 CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921", "creation_timestamp": "2026-09-20T05:20:11.494311Z"}, {"uuid": "9ab04c6e-34e5-49f2-97d9-a8e1b298bc5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pwczh2b", "content": "CVE-2026-59901 CVE-2026-59903 CVE-2026-59921 CVE-2026-73508 CVE-2026-75595 CVE-2026-75596 N/A Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerability: GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-operators", "creation_timestamp": "2026-09-20T05:20:13.074617Z"}, {"uuid": "4eb84294-e92f-4d47-8370-df2a14b659e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6qozcp2v", "content": "Security fixes for apigee-runtime. This addresses the following vulnerabilities: CVE-2026-55831 CVE-2026-55833 CVE-2026-56745 CVE-2026-56746 CVE-2026-56819 CVE-2026-59898 CVE-2026-59899 CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921 CVE-2026-73508 CVE-2026-75595", "creation_timestamp": "2026-09-20T05:20:17.219145Z"}, {"uuid": "9c1fc7c5-a255-46d8-a8f0-53c68d101908", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6qumx42f", "content": "CVE-2026-75596 N/A Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: CVE-2026-55831 CVE-2026-55833 CVE-2026-56745 CVE-2026-56746 CVE-2026-56819 CVE-2026-59898 CVE-2026-59899 CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921", "creation_timestamp": "2026-09-20T05:20:18.513809Z"}, {"uuid": "515a214d-c51a-42a3-a9bc-7e8dffc3d7fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5372l2h", "content": "CVE-2026-56819 CVE-2026-59889 CVE-2026-59898 CVE-2026-59899 CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921 CVE-2026-73508 GHSA-mhm7-754m-9p8w N/A Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerabilities: CVE-2026-43871", "creation_timestamp": "2026-09-25T05:40:14.415059Z"}, {"uuid": "286db047-f6f9-4762-8d85-8529e503c955", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n4vfj32h", "content": "CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921 CVE-2026-73508 GHSA-mhm7-754m-9p8w N/A Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: CVE-2026-54515 CVE-2026-55831 CVE-2026-55833 CVE-2026-56745 CVE-2026-56746", "creation_timestamp": "2026-09-25T05:40:13.422504Z"}, {"uuid": "bbea3973-1b33-4cf4-b475-683fea55313d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n66rpq2k", "content": "CVE-2026-56819 CVE-2026-59889 CVE-2026-59898 CVE-2026-59899 CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921 CVE-2026-73508 CVE-2026-75595 CVE-2026-75596 GHSA-mhm7-754m-9p8w N/A Security fixes for apigee-synchronizer. This addresses the following vulnerabilities:", "creation_timestamp": "2026-09-25T05:40:19.121933Z"}, {"uuid": "b8743624-988d-44e5-b33d-1993ef05fd60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59903", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n6eobl2w", "content": "CVE-2026-54515 CVE-2026-55831 CVE-2026-55833 CVE-2026-56745 CVE-2026-56746 CVE-2026-56819 CVE-2026-59889 CVE-2026-59898 CVE-2026-59899 CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921 CVE-2026-73508 GHSA-mhm7-754m-9p8w N/A Security fixes for apigee-watcher. This", "creation_timestamp": "2026-09-25T05:40:19.885909Z"}]}