CVE-2026-59920
Description
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
How to fix
- netty netty4.1.136, 4.2.16 or later
- io.netty:netty-codec-stomp4.2.16.Final, 4.1.136.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | v < 4.1.136, 4.2.0 ≤ v < 4.2.16 | 4.1.136, 4.2.16 |
| io.netty:netty-codec-stompMaven | 4.2.0.Final ≤ v < 4.2.16.Final, v < 4.1.136.Final | 4.2.16.Final, 4.1.136.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.