CVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

July 22, 2026

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

References

github.com/advisories/GHSA-4mp9-239f-g9hg
github.com/netty/netty/releases/tag/netty-4.1.136.Final
github.com/netty/netty/releases/tag/netty-4.2.16.Final
github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg
nvd.nist.gov/vuln/detail/CVE-2026-59898

Code Behaviors & Features

Detect and mitigate CVE-2026-59898 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →