CVE-2026-62380

The CVSS 6.3 rating masks a deployment-dependent risk multiplier. The vulnerability—missing input validation in Netty's SOCKS4 and SOCKS5 client encoders—affects null-byte injection in destination domains, CRLF injection in authentication fields, and userid truncation in SOCKS4a requests. The critical analytical question is whether your Netty deployment accepts untrusted destination domains or user credentials that flow through these encoders toward an upstream SOCKS proxy. In forward proxy configurations where external clients specify target domains, an attacker could exploit null-byte injection to bypass domain allowlists—truncating a benign domain and appending a malicious suffix that passes validation but routes elsewhere. In authenticated proxy scenarios, CRLF injection in the username field could corrupt the handshake and potentially hijack sessions for other users on the same proxy. The SOCKS4 userid truncation issue is particularly concerning in multi-tenant environments: truncating the userid could cause authentication to bind to a different user account than intended. The protocol confusion vector elevates this from application-level flaw to network security concern. Because the encoders fail to sanitize output at the wire-format level, a malicious client could craft SOCKS frames that appear benign to inspection systems but carry payloads that upstream proxies misinterpret. This creates evasion opportunities against SOCKS-aware security controls. Check your deployment: identify whether your Netty-based SOCKS client accepts destination domains or credentials from untrusted sources, whether you run a forward proxy serving external clients, and whether authentication state could be confused across users. The 4.1.x branch's longer unpatched window (through 4.1.136 versus 4.2.16) matters if you're on the LTS track—your exposure window is measurably longer and your update path may require more coordination.

Reviewed through automated stages and approved by a human before publication.