Skip to main content

Netty netty-codec-http CVE-2026-59898

| EUVDEUVD-2026-50444 MEDIUM
HTTP Request/Response Smuggling (CWE-444)
2026-07-22 https://github.com/netty/netty GHSA-4mp9-239f-g9hg
Request Smuggling Information Disclosure
6.3
CVSS 4.0 · Vendor: https://github.com/netty/netty
Share

Severity by source

Vendor (https://github.com/netty/netty) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network-reachable with no auth required, but AC:H because smuggling impact requires a proxy intermediary; S:C for cross-boundary desync affecting proxy and co-tenant HTTP sessions; no availability impact described.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
5.4 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (https://github.com/netty/netty).

CVSS VectorVendor: https://github.com/netty/netty

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
CVSS changed
Jul 29, 2026 - 19:22 NVD
6.3 (MEDIUM)
Source Code Evidence Fetched
Jul 22, 2026 - 22:21 vuln.today
Analysis Generated
Jul 22, 2026 - 22:21 vuln.today
CVE Published
Jul 22, 2026 - 21:48 cve.org
MEDIUM

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 344 maven packages depend on io.netty:netty-codec-http (32 direct, 312 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

DescriptionCVE.org

Summary

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

AnalysisAI

WebSocket protocol upgrade in Netty's V07/V08 handshakers completes without enforcing RFC 6455-mandatory Connection: Upgrade and Upgrade: websocket headers, enabling an attacker to silently switch protocols in a way that upstream reverse proxies and load balancers do not recognize as an Upgrade request. This desynchronization between proxy and backend creates a classic HTTP request smuggling vector (CWE-444) that can be exploited to poison shared connections, bypass proxy-enforced access controls, or hijack other users' HTTP sessions. Affected versions are io.netty:netty-codec-http prior to 4.1.136.Final and 4.2.0.Final through 4.2.15.Final; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Netty is a high-performance, asynchronous, event-driven network application framework for Java, widely used as the HTTP/WebSocket engine in enterprise middleware, microservice frameworks (Vert.x, Quarkus, Spring WebFlux), and cloud-native services. The affected Maven artifact is io.netty:netty-codec-http. The V07 and V08 WebSocket handshakers (WebSocketServerHandshaker07, WebSocketServerHandshaker08) predate the standardized RFC 6455 (V13) handshaker and historically applied looser validation. The root cause (CWE-444 - Inconsistent Interpretation of HTTP Requests) is that these handshakers check the Sec-WebSocket-Version: 7 or 8 header to identify WebSocket upgrade intent but do not validate the presence of the co-required Connection: Upgrade and Upgrade: websocket headers. RFC 6455 §4.1 mandates both, and reverse proxies universally use these headers to identify and route upgrade traffic. Without them, the proxy classifies the request as normal HTTP while Netty's backend transitions the connection to WebSocket - a textbook protocol desync that is the prerequisite for HTTP request smuggling.

RemediationAI

Upgrade io.netty:netty-codec-http to version 4.1.136.Final (4.1.x line) or 4.2.16.Final (4.2.x line); both are confirmed fixed releases available from the Netty project at https://github.com/netty/netty/releases/tag/netty-4.1.136.Final and https://github.com/netty/netty/releases/tag/netty-4.2.16.Final. For transitive dependencies via frameworks such as Spring WebFlux or Reactor Netty, override the Netty BOM version in your dependency management to force the patched artifact version - verify the effective version with mvn dependency:tree or gradle dependencies. If patching is not immediately possible, configure the upstream proxy (nginx, HAProxy, AWS ALB) to reject any WebSocket handshake request that lacks both Connection: Upgrade and Upgrade: websocket headers before forwarding to Netty; this eliminates the proxy-side desync but may reject non-compliant but legitimate legacy WebSocket clients using V07/V08. A narrower alternative is to restrict WebSocketServerHandshakerFactory to V13-only by passing the appropriate version parameter, eliminating the vulnerable code path if your clients do not require V07/V08 support.

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Same technique Request Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

CVE-2026-59898 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy