---
id: CVE-2026-59898
aliases:
  - GHSA-4mp9-239f-g9hg
title: 'Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation'
summary: 'Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation'
severity: medium
cwe:
  - CWE-444
vendor: netty
product: 'io.netty:netty-codec-http'
ecosystem: maven
affected:
  - 'io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final'
  - 'io.netty:netty-codec-http < 4.1.136.Final'
patched:
  - 'io.netty:netty-codec-http 4.2.16.Final'
  - 'io.netty:netty-codec-http 4.1.136.Final'
published: '2026-07-22'
updated: '2026-07-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-4mp9-239f-g9hg'
references:
  - url: 'https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg'
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.1.136.Final'
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.2.16.Final'
  - url: 'https://github.com/advisories/GHSA-4mp9-239f-g9hg'
tags:
  - ghsa
  - maven
ingestedAt: '2026-07-22T22:06:57.704Z'
epss: 0.00439
epssPercentile: 0.35537
---

## Overview

## Summary
An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

## Affected packages

- `io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final`
- `io.netty:netty-codec-http < 4.1.136.Final`

## Remediation

Upgrade to a patched release:

- `io.netty:netty-codec-http 4.2.16.Final`
- `io.netty:netty-codec-http 4.1.136.Final`