CVE-2026-59898

UNKNOWN 0.0

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CWE	CWE-444
Vendor	netty
Product	netty
Published	Jul 29, 2026

Stay Ahead of the Next One

Get instant alerts for netty netty

Be the first to know when new unknown vulnerabilities affecting netty netty are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

netty / netty

>=4.2.0.Final, < 4.2.16.Final < 4.1.136.Final

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg github.com: https://github.com/netty/netty/releases/tag/netty-4.1.136.Final github.com: https://github.com/netty/netty/releases/tag/netty-4.2.16.Final