CVE-2026-59898

Summary

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Severity

medium

EPSS

0.4% (p38)

CWE

CWE-444

Also known as

GHSA-4mp9-239f-g9hg

Published

2026-07-22

Updated

2026-07-22

Advisory details

Summary

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

References

• https://github.com/advisories/GHSA-4mp9-239f-g9hg
• https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final

Related advisories

• CVE-2026-56745 — high · Maven/io.netty:netty-codec-http
• CVE-2026-55833 — high · Maven/io.netty:netty-codec-http
• CVE-2026-55831 — high · Maven/io.netty:netty-codec-http
• CVE-2026-42587 — high · Maven/io.netty:netty-codec-http
• CVE-2026-42584 — high · Maven/io.netty:netty-codec-http
• CVE-2026-33870 — high · Maven/io.netty:netty-codec-http
• CVE-2026-59903 — medium · Maven/io.netty:netty-codec-http
• CVE-2026-59921 — medium · Maven/io.netty:netty-codec-http

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity