{"id":"CVE-2026-59898","aliases":["GHSA-4mp9-239f-g9hg"],"title":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation","summary":"Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation","severity":"medium","cwe":["CWE-444"],"vendor":"netty","product":"io.netty:netty-codec-http","ecosystem":"maven","affected":["io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final","io.netty:netty-codec-http < 4.1.136.Final"],"patched":["io.netty:netty-codec-http 4.2.16.Final","io.netty:netty-codec-http 4.1.136.Final"],"published":"2026-07-22","updated":"2026-07-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4mp9-239f-g9hg","references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"},{"url":"https://github.com/advisories/GHSA-4mp9-239f-g9hg"}],"tags":["ghsa","maven"],"ingestedAt":"2026-07-22T22:06:57.704Z","epss":0.00249,"epssPercentile":0.16586,"slug":"CVE-2026-59898","body":"## Overview\n\n## Summary\nAn attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.\n\n## Affected packages\n\n- `io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final`\n- `io.netty:netty-codec-http < 4.1.136.Final`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `io.netty:netty-codec-http 4.2.16.Final`\n- `io.netty:netty-codec-http 4.1.136.Final`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}