PT-2026-63546 · Maven · Io.Netty:Netty-Codec-Http

CVE-2026-59898 · Publicado 2026-07-22 · Atualizado 2026-07-22

OSV

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Summary

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

Correção

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2026-59898

GHSA-4MP9-239F-G9HG

Produtos afetados

Io.Netty:Netty-Codec-Http

Referências · 5

• https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg · Nota
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Nota
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Nota
• https://github.com/netty/netty · Nota
• https://osv.dev/vulnerability/GHSA-4mp9-239f-g9hg · Aviso do Fabricante