logo

Database

HTTP request smuggling In io.netty:netty-codec-http

Description

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Summary

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-598982. NVD-2026-598983. OSV-2026-598984. GHSA-4mp9-239f-g9hg5. GCVE-2026-59898

References

1. https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg2. https://github.com/netty/netty/releases/tag/netty-4.1.136.Final3. https://github.com/netty/netty/releases/tag/netty-4.2.16.Final

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.