CVE-2026-56746¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Netty's CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately. Due to a logical operator error in the origin evaluation process, this protection can be bypassed entirely by sending a request with an Origin: null header, forwarding unauthorized requests to the backend application. Fixed in 4.1.136.Final and 4.2.16.Final.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
A single Netty distribution reaches the runtime in WSO2 Identity Server, shipped as a WSO2 orbit bundle that re-wraps an upstream release within the affected range. The vulnerable class is therefore physically present, and this finding turns entirely on whether it is reachable.
The CORS handler is never used. Nothing in the shipped distribution references any io.netty.handler.codec.http.cors class; it appears only inside the Netty bundle itself. A Netty HTTP server pipeline with a CorsHandler installed and shortCircuit() enabled does not exist in this product. Cross-origin policy for the product's own endpoints is enforced by the WSO2 CORS valve running in the Tomcat request pipeline, which is unaffected by this defect.
No Netty HTTP server is ever started. io.netty.handler.codec.http.HttpServerCodec and io.netty.handler.codec.spdy.SpdyFrameCodec are referenced by nothing in the shipped distribution, so no Netty server pipeline is ever built. WSO2 Identity Server serves all inbound HTTP through embedded Apache Tomcat, configured in repository/conf/tomcat/catalina-server.xml.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.