Null Byte Interaction Error (Poison Null Byte) in Netty - CVE-2026-62380
Published: August 8, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU141322
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-62380
CWE-ID: CWE-626
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoof domains and inject authentication data.
The vulnerability exists due to null byte interaction error in Socks4ClientEncoder and Socks5ClientEncoder when encoding SOCKS4 or SOCKS5 fields containing embedded null bytes or control characters. A remote attacker can supply specially crafted domain names, user identifiers, usernames, or passwords to spoof domains and inject authentication data.
Different proxy implementations may truncate null-terminated values differently, which can cause protocol ambiguity in SOCKS4 and altered interpretation of SOCKS5 destination and credential fields.
Affected software
Netty
How to mitigate CVE-2026-62380
Install security update from vendor's website.
Netty - addressed in versions 4.1.137, 4.2.17