Summary
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
Advisory details
Summary
An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-55087
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
- MEDIUMCVE-2026-62899
Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
- MEDIUMCVE-2026-71554
h2: Duplicate Host header could facilitate request smuggling
- HIGHCVE-2026-71324
Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- MEDIUMCVE-2026-69243
AIOHTTP: HTTP request smuggling via WebSocket upgrade
- MEDIUMCVE-2026-16728
undici vulnerable to downstream response desynchronization via retry interceptor