PT-2026-63546 · Maven · Io.Netty:Netty-Codec-Http

CVE-2026-59898 · Published 2026-07-22 · Updated 2026-07-22

OSV

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Summary

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-59898

GHSA-4MP9-239F-G9HG

Affected Products

Io.Netty:Netty-Codec-Http

References · 5

• https://osv.dev/vulnerability/GHSA-4mp9-239f-g9hg · Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note
• https://github.com/netty/netty · Note