CVE-2026-59920: Netty: STOMP CONNECT Frame Header Injection in Netty

FieldValue
ProductNetty
Version4.2.12.Final (and all prior versions with codec-stomp)
Componentio.netty.handler.codec.stomp.StompSubframeEncoder
Vulnerability TypeCWE-93: Improper Neutralization of CRLF Sequences / CWE-113: Improper Neutralization of CRLF in HTTP Headers
ImpactSTOMP Header Injection / Authentication Bypass
CVSS 3.1 Score6.5 (Medium)
CVSS 3.1 VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
Confidentiality ImpactNone
Integrity ImpactHigh
Availability ImpactNone

References

Code Behaviors & Features

Detect and mitigate CVE-2026-59920 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →