CVE-2026-56746

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>netty</name>
	<range><lt>4.1.136</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Netty is a network application framework for development of protocol
	servers and clients. Versions 4.2.0.Final through 4.2.15.Final and
	4.1.0.Final through 4.1.135.Final, are vulnerable to security control
	bypass during the origin evaluation process. CorsHandler provides a
	shortCircuit() configuration designed to reject unauthorized
	cross-origin requests immediately, acting as a security control before
	requests reach the application. However, due to a logical operator
	error in the origin evaluation process, this protection can be
	entirely bypassed. An attacker can bypass the short-circuit mechanism
	by sending a request with an Origin: null header. This failure
	forwards unauthorized requests to the backend application, bypassing
	intended access controls. This issue is fixed in versions
	4.1.136.Final and 4.2.16.Final.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-56746</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-56746</url>
    </references>
    <dates>
      <discovery>2026-07-21</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>