CVE-2026-59898 Overview
CVE-2026-59898 affects Netty, an asynchronous, event-driven network application framework widely embedded in Java-based servers, proxies, and middleware. The flaw exists in the lax V07 and V08 WebSocket handshakers. An attacker can trigger a WebSocket protocol switch by sending Sec-WebSocket-Version: 7 while omitting the standard Connection: Upgrade and Upgrade: websocket headers. Upstream proxies do not recognize the exchange as an Upgrade request, but the Netty backend completes the switch. This desynchronization enables HTTP request smuggling and protocol-confusion attacks [CWE-444]. The issue is resolved in Netty 4.1.136.Final and 4.2.16.Final.
Critical Impact
Attackers can smuggle malicious HTTP requests through intermediaries, bypass front-end security controls, and hijack requests belonging to other users on shared connections.
Affected Products
- Netty versions prior to 4.1.136.Final (4.1.x branch)
- Netty versions prior to 4.2.16.Final (4.2.x branch)
- Applications and proxies embedding the WebSocket07FrameDecoder / WebSocket08FrameDecoder handshakers
Discovery Timeline
- 2026-07-29 - CVE-2026-59898 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-59898
Vulnerability Analysis
The vulnerability lies in Netty's handling of the WebSocket opening handshake for protocol versions 7 and 8. RFC 6455 requires the client to include both Connection: Upgrade and Upgrade: websocket headers to signal a protocol switch. Netty's V07 and V08 handshakers accept the presence of Sec-WebSocket-Version: 7 (or 8) alone as sufficient to complete the upgrade. The server responds with 101 Switching Protocols and treats subsequent bytes on the connection as WebSocket frames. Front-end proxies inspecting only standard upgrade headers continue to treat the connection as HTTP/1.1 and forward pipelined requests, creating a classic request-smuggling desynchronization [CWE-444].
Root Cause
The handshake validation logic is permissive. The V07 and V08 handshakers do not enforce the mandatory Connection and Upgrade header pair before completing the protocol switch. This lax check violates the HTTP upgrade contract and diverges from the interpretation of intermediate proxies.
Attack Vector
An unauthenticated remote attacker sends a crafted HTTP request through a shared front-end proxy to a Netty backend. The request omits Connection: Upgrade and Upgrade: websocket but includes Sec-WebSocket-Version: 7 and the required WebSocket key. The proxy treats the message as a plain HTTP request; Netty accepts it as a WebSocket upgrade. Bytes appended after the smuggled request are interpreted by the backend as WebSocket frames or as a second HTTP request, enabling cache poisoning, credential theft, and control-flow bypass across users sharing the connection.
No verified exploit code is currently published. See the GitHub Security Advisory GHSA-4mp9-239f-g9hg for authoritative technical details.
Detection Methods for CVE-2026-59898
Indicators of Compromise
- HTTP requests containing Sec-WebSocket-Version: 7 or Sec-WebSocket-Version: 8 without matching Connection: Upgrade and Upgrade: websocket headers.
- Backend 101 Switching Protocols responses that do not correlate with an Upgrade request logged at the front-end proxy.
- Unexpected binary or framed traffic following what proxies logged as a completed HTTP transaction.
Detection Strategies
- Deploy WAF or reverse-proxy rules that reject WebSocket handshake attempts missing the mandatory Connection and Upgrade headers.
- Correlate proxy access logs against backend application logs to identify handshake outcomes that disagree on the request type.
- Inspect Netty pipeline versions via dependency scanning of build artifacts (netty-codec-http prior to 4.1.136.Final and 4.2.16.Final).
Monitoring Recommendations
- Alert on anomalous ratios of 101 Switching Protocols responses per source IP or endpoint.
- Track requests with pipelined bodies following upgrade attempts on the same TCP connection.
- Monitor for repeated malformed WebSocket handshakes originating from a single client, which may indicate exploitation attempts.
How to Mitigate CVE-2026-59898
Immediate Actions Required
- Upgrade Netty to 4.1.136.Final on the 4.1 branch or 4.2.16.Final on the 4.2 branch.
- Inventory all Java services and shaded dependencies that ship Netty transitively; frameworks such as reactive HTTP servers and API gateways frequently bundle Netty.
- Restart affected services after applying the update to ensure the patched handshaker is loaded.
Patch Information
The fix is available in the Netty 4.1.136.Final release and the Netty 4.2.16.Final release. Both releases tighten the V07 and V08 handshakers to require the presence of Connection: Upgrade and Upgrade: websocket headers before completing the protocol switch.
Workarounds
- Terminate WebSocket handshakes at a front-end proxy that strictly validates Connection and Upgrade headers before forwarding upstream.
- Disable WebSocket protocol versions 7 and 8 in application configuration if not required by clients.
- Enforce HTTP/2 or HTTP/3 between the proxy and the Netty backend, which eliminates the connection-reuse assumptions that request smuggling depends on.
# Maven dependency update example
mvn versions:use-dep-version -Dincludes=io.netty:netty-all -DdepVersion=4.1.136.Final -DforceVersion=true
# Gradle dependency update example
# In build.gradle:
# implementation 'io.netty:netty-all:4.1.136.Final'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
