Io.netty:netty codec http: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation (CVE-2026-59898)
A vulnerability in io.netty:netty-codec-http's WebSocket V07/V08 handshaker allows an attacker to force a WebSocket upgrade by sending a Sec-WebSocket-Version: 7 header while omitting the required Connection: Upgrade and Upgrade: websocket headers. This causes the protocol switch to complete even though a proxy may not recognize it as an upgrade request, potentially enabling HTTP request smuggling or protocol confusion attacks.
AI Analysis
Technical Summary
The io.netty:netty-codec-http library contains a vulnerability (CVE-2026-59898) in its WebSocket V07 and V08 handshaker implementations. The handshaker does not properly validate the presence of the Connection: Upgrade and Upgrade: websocket headers when processing a WebSocket upgrade request with Sec-WebSocket-Version: 7. This lax validation allows an attacker to complete a protocol switch without the proxy recognizing it as an upgrade, which can facilitate HTTP request smuggling or protocol confusion attacks. The vulnerability is categorized under CWE-444 (Improper Dependency Resolution).
Potential Impact
An attacker can exploit this vulnerability to bypass proxy detection of WebSocket upgrade requests, enabling HTTP request smuggling or protocol confusion attacks. These attacks can lead to request interception, manipulation, or other downstream impacts depending on the environment and proxy behavior. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor vendor advisories for updates and consider mitigating exposure by disabling support for WebSocket versions V07/V08 if feasible.
Io.netty:netty codec http: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation (CVE-2026-59898)
Description
A vulnerability in io.netty:netty-codec-http's WebSocket V07/V08 handshaker allows an attacker to force a WebSocket upgrade by sending a Sec-WebSocket-Version: 7 header while omitting the required Connection: Upgrade and Upgrade: websocket headers. This causes the protocol switch to complete even though a proxy may not recognize it as an upgrade request, potentially enabling HTTP request smuggling or protocol confusion attacks.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The io.netty:netty-codec-http library contains a vulnerability (CVE-2026-59898) in its WebSocket V07 and V08 handshaker implementations. The handshaker does not properly validate the presence of the Connection: Upgrade and Upgrade: websocket headers when processing a WebSocket upgrade request with Sec-WebSocket-Version: 7. This lax validation allows an attacker to complete a protocol switch without the proxy recognizing it as an upgrade, which can facilitate HTTP request smuggling or protocol confusion attacks. The vulnerability is categorized under CWE-444 (Improper Dependency Resolution).
Potential Impact
An attacker can exploit this vulnerability to bypass proxy detection of WebSocket upgrade requests, enabling HTTP request smuggling or protocol confusion attacks. These attacks can lead to request interception, manipulation, or other downstream impacts depending on the environment and proxy behavior. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor vendor advisories for updates and consider mitigating exposure by disabling support for WebSocket versions V07/V08 if feasible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4mp9-239f-g9hg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59898"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6150d69c2644c7f8da0c1b
Added to database: 07/22/2026, 23:23:02 UTC
Last enriched: 07/22/2026, 23:30:11 UTC
Last updated: 07/22/2026, 23:30:11 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.