GitStock

netty/netty · Security

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Open GitHub
GHSA ID
GHSA-4mp9-239f-g9hg
CVE ID
CVE-2026-59898
Severity
medium
Published
Updated
CVSS v4
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Description

Summary

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

CWEs

  • CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

References