Netty's STOMP codec encoder (StompSubframeEncoder) intentionally skips escaping header values for CONNECT and CONNECTED commands to maintain backward compatibility with STOMP 1.0 clients, per the STOMP 1.2 specification. However, this skipping also omits validation of newline characters in header values, allowing raw newline characters to be written directly to the output. This enables an attacker to inject additional STOMP headers by including newline characters in CONNECT frame headers. The vulnerability is due to conflating escaping with validation: while escaping is skipped as per spec, validation to reject malformed headers containing raw newlines is missing. This can lead to header injection and potential authentication bypass in downstream STOMP brokers that process the injected headers. Exploitation requires user-controlled input in CONNECT frame headers and lack of sanitization by the application. The vulnerability affects the encodeHeaders() and shouldEscape() methods in StompSubframeEncoder. No official patch or fix is currently documented.

The vulnerability allows an attacker with low privileges and no user interaction to inject additional STOMP headers into CONNECT frames by including raw newline characters in header values. This can lead to authentication bypass in downstream STOMP brokers that parse the injected headers. Confidentiality and availability impacts are not affected, but integrity impact is high due to the ability to manipulate protocol headers. The attack vector is network-based and complexity is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications using Netty's codec-stomp module should implement input validation to reject or sanitize newline characters in CONNECT frame header values to prevent injection. Avoid placing user-controlled input directly into CONNECT headers without sanitization. Monitor vendor advisories for updates or patches addressing this issue.