Netty: Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending… (CVE-2026-59898)
Description
Netty versions prior to 4.1.136.Final and 4.2.16.Final contain a vulnerability where an attacker can force a WebSocket upgrade using the lax V07 or V08 handshaker by sending a Sec-WebSocket-Version: 7 header while omitting the required Connection: Upgrade and Upgrade: websocket headers. This causes the protocol switch to complete in a way that proxies do not recognize as an upgrade request, enabling HTTP request smuggling or protocol confusion attacks. The issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/ubuntu/netty?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/netty?arch=source&distro=esm-apps-legacy/xenialpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/netty?arch=source&distro=stonkingpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59898 affects Netty versions prior to 4.1.136.Final and 4.2.16.Final. The vulnerability arises because the WebSocket upgrade process using the V07 or V08 handshaker is lax: an attacker can send a Sec-WebSocket-Version: 7 header without the mandatory Connection: Upgrade and Upgrade: websocket headers. This causes the protocol switch to complete improperly, leading to scenarios where proxies fail to recognize the upgrade request. This behavior enables HTTP request smuggling or protocol confusion attacks. The vulnerability is addressed in Netty versions 4.1.136.Final and 4.2.16.Final.
Potential Impact
The vulnerability enables attackers to perform HTTP request smuggling or protocol confusion attacks by exploiting the improper handling of WebSocket upgrade requests. This can lead to interference with proxy behavior and potentially allow malicious HTTP requests to bypass security controls or cause unexpected behavior in downstream systems. There is no indication of direct confidentiality or availability impact, but integrity is impacted due to the possibility of request manipulation.
Mitigation Recommendations
A fix is available in Netty versions 4.1.136.Final and 4.2.16.Final. Users should upgrade to these versions or later to remediate the vulnerability. No other specific mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4mp9-239f-g9hg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59898"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6150d69c2644c7f8da0c1b
Added to database: 07/22/2026, 23:23:02 UTC
Last enriched: 10/18/2026, 04:35:22 UTC
Last updated: 10/21/2026, 13:20:22 UTC
Views: 147
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.