VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 29, 2026· Updated Aug 6, 2026

CVE-2026-59898

CVE-2026-59898

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.netty:netty-codec-httpMaven
>= 4.2.0.Final, < 4.2.16.Final4.2.16.Final
io.netty:netty-codec-httpMaven
< 4.1.136.Final4.1.136.Final

Affected products

243

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.