~ / search / GHSA-4mp9-239f-g9hg

GHSA-4mp9-239f-g9hg

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-59898

Packages

EcosystemPackageAffectedFixed in
Maven io.netty:netty-codec-http >= 4.2.0.Final, < 4.2.16.Final 4.2.16.Final
Maven io.netty:netty-codec-http < 4.1.136.Final 4.1.136.Final

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

References

External links from the advisory. They lead to third-party sites.