CVE-2026-59920

Received Received - Intake

Netty STOMP Header Injection Vulnerability

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-59920

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.2.16.Final (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability affects Netty, a network application framework. In versions before 4.1.136.Final and 4.2.16.Final, the STOMP encoder does not properly handle newline characters in header values for CONNECT and CONNECTED frames. Attackers can inject additional STOMP headers by including raw newlines in user-controlled values like login or passcode, potentially bypassing authentication or escalating privileges.

Detection Guidance

Detecting this vulnerability requires inspecting network traffic for STOMP frames with raw newline characters in CONNECT or CONNECTED headers. Use packet capture tools like tcpdump or Wireshark to analyze traffic on ports used by STOMP (typically 61613, 61614, or custom ports). Look for malformed headers containing newline characters that could indicate exploitation attempts.

Impact Analysis

If you use a vulnerable version of Netty with STOMP support, an attacker controlling a header value could inject malicious headers to overwrite connection parameters, bypass authentication, or escalate privileges. The impact depends on the STOMP broker being used.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, potentially violating data protection requirements under GDPR or HIPAA. Organizations using vulnerable Netty versions may fail compliance audits if exploitation results in data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or 4.2.16.Final or later to address the root cause.
If upgrading is not immediately possible, implement network-level controls to filter malformed STOMP frames containing newline characters in headers.
Monitor STOMP traffic for suspicious header manipulation attempts, especially in authentication-related fields like login or passcode.

Hi! I’m here to help you understand CVE-2026-59920. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70