Null Byte Interaction Error (Poison Null Byte) in Netty - #VU141322
Published: August 8, 2026
Vulnerability identifier: #VU141322
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-626
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoof domains and inject authentication data.
The vulnerability exists due to null byte interaction error in Socks4ClientEncoder and Socks5ClientEncoder when encoding SOCKS4 or SOCKS5 fields containing embedded null bytes or control characters. A remote attacker can supply specially crafted domain names, user identifiers, usernames, or passwords to spoof domains and inject authentication data.
Different proxy implementations may truncate null-terminated values differently, which can cause protocol ambiguity in SOCKS4 and altered interpretation of SOCKS5 destination and credential fields.
Affected software
Netty
Remediation
Install security update from vendor's website.
Netty - addressed in versions 4.1.137, 4.2.17