CVE-2026-59898

Analyzed Analyzed - Analysis Complete

WebSocket Protocol Confusion in Netty

Publication date: 2026-07-29

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-06

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-59898

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.1.136 (exc)
netty	netty	From 4.2.0 (inc) to 4.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability in Netty allows an attacker to force a WebSocket upgrade by sending a specific header without required connection details. This can trick proxies into misclassifying the request, enabling HTTP request smuggling or protocol confusion attacks.

Detection Guidance

To detect this vulnerability, inspect network traffic for WebSocket upgrade attempts with Sec-WebSocket-Version: 7 header while missing required Connection: Upgrade and Upgrade: websocket headers. Check Netty versions in use; vulnerable versions are below 4.1.136.Final and 4.2.16.Final.

Impact Analysis

An attacker could exploit this to bypass security controls, intercept or modify traffic, or send unauthorized requests through affected systems. This may lead to data breaches, service disruption, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or later for the 4.1.x branch, or to version 4.2.16.Final or later for the 4.2.x branch to address the WebSocket upgrade vulnerability.

Hi! I’m here to help you understand CVE-2026-59898. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70