CVE-2026-59898: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

July 22, 2026

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

References

github.com/advisories/GHSA-4mp9-239f-g9hg
github.com/netty/netty/releases/tag/netty-4.1.136.Final
github.com/netty/netty/releases/tag/netty-4.2.16.Final
github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg
nvd.nist.gov/vuln/detail/CVE-2026-59898

Code Behaviors & Features

Detect and mitigate CVE-2026-59898 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →