CVE-2026-59920: Netty STOMP Auth Bypass Vulnerability

CVE-2026-59920 Overview

CVE-2026-59920 is a header injection vulnerability [CWE-93] in Netty, an asynchronous, event-driven network application framework widely used in Java-based network services. The flaw exists in the StompSubframeEncoder, which fails to escape or validate header values in CONNECT and CONNECTED frames. Attackers who control a header value can inject raw newline (\n) characters to append arbitrary STOMP headers. The issue affects Netty versions prior to 4.1.136.Final and 4.2.16.Final.

Critical Impact
An attacker controlling a user-supplied login or passcode value can inject additional headers to overwrite connection parameters, bypass authentication, or escalate privileges. The exact outcome depends on the broker consuming the STOMP frame.

Affected Products

Netty versions prior to 4.1.136.Final
Netty versions prior to 4.2.16.Final
Applications using StompSubframeEncoder to build STOMP CONNECT or CONNECTED frames with attacker-influenced header values

Discovery Timeline

2026-07-29 - CVE-2026-59920 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-59920

Vulnerability Analysis

The Simple Text Oriented Messaging Protocol (STOMP) uses a line-delimited frame format where each header occupies its own line terminated by a newline. Netty's StompSubframeEncoder writes header values directly to the wire for CONNECT and CONNECTED frames without escaping embedded newline characters.

The STOMP 1.2 specification instructs implementations to skip escape processing for these two frame types to preserve backward compatibility with STOMP 1.0 clients. Netty followed the specification but did not add a compensating validation step. As a result, any newline embedded in a header value produces additional header lines on the wire.

Downstream brokers parse each line as a distinct header entry, so injected headers become legitimate protocol input. This enables an attacker to add authentication or role headers, or to redefine parameters such as host or passcode.

Root Cause

The root cause is missing input validation in the encoding path for CONNECT and CONNECTED frames. The encoder intentionally skips escaping per specification but never rejects raw \n, \r, or \0 characters that would break frame boundaries.

Attack Vector

Exploitation requires an attacker to control the value of at least one header written into a CONNECT or CONNECTED frame. Typical exploitation involves user-supplied credentials passed through as the login or passcode header. The attacker embeds \n in the value along with a forged header such as an authentication token or role claim. The receiving broker treats the injected line as an independent header, altering session establishment. Impact is broker-dependent and ranges from parameter overwrite to authentication bypass or privilege escalation.

No public proof-of-concept or exploit code has been published for CVE-2026-59920. See the GitHub Security Advisory for advisory details.

Detection Methods for CVE-2026-59920

Indicators of Compromise

STOMP CONNECT or CONNECTED frames containing embedded \n or \r bytes inside a single header value on the wire
Broker authentication logs showing unexpected header keys such as duplicated login, passcode, or role-related headers within a single frame
Successful authentication events where the observed principal does not match the credentials supplied by the client application

Detection Strategies

Inspect application logs and network captures for STOMP frames whose header count on the broker side exceeds the count set by the client
Enable dependency scanning to flag Netty versions below 4.1.136.Final and 4.2.16.Final in build manifests and container images
Add server-side validation in the broker to reject frames with duplicate authentication headers and alert on rejections

Monitoring Recommendations

Monitor outbound STOMP traffic from services that accept user-supplied credentials for anomalous header patterns
Alert on authentication anomalies where session role or identity changes mid-handshake
Track Netty version inventory across services and pipelines and alert when vulnerable versions are deployed to production

How to Mitigate CVE-2026-59920

Immediate Actions Required

Upgrade Netty to 4.1.136.Final or 4.2.16.Final across all services that produce STOMP frames
Audit application code paths that place user-controlled data into STOMP CONNECT or CONNECTED headers, particularly login and passcode
Reject or sanitize any header value containing \n, \r, or \0 before it reaches the encoder

Patch Information

The Netty project fixed CVE-2026-59920 in versions 4.1.136.Final and 4.2.16.Final. Consult the Netty GitHub Security Advisory GHSA-3g8r-4pfx-jmfh for the full remediation notes and patch commits.

Workarounds

Wrap calls that build STOMP frames with a validator that rejects header values containing control characters
Enforce credential length and character-set restrictions at the application boundary before they reach Netty's encoder
Configure the STOMP broker to reject frames with duplicate login, passcode, or authorization headers where feasible

bash

# Example Maven dependency update to a fixed version
<dependency>
  <groupId>io.netty</groupId>
  <artifactId>netty-codec-stomp</artifactId>
  <version>4.1.136.Final</version>
</dependency>