CVE-2026-59920: 
Java Schwachstellenanalyse und -minderung

CVE-2026-59920 is a CRLF/newline injection vulnerability in Netty's STOMP codec that allows low-privileged network attackers to inject arbitrary headers into STOMP CONNECT frames, potentially enabling authentication bypass and privilege escalation. It affects the Maven artifact io.netty:netty-codec-stomp in versions >= 4.2.0.Final up to (excluding) 4.2.16.Final, and all versions up to (excluding) 4.1.136.Final. The vulnerability was published by Netty maintainer normanmaurer on July 14, 2026, and added to the GitHub Advisory Database on July 22, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Netty Security Advisory).

The root cause is in io.netty.handler.codec.stomp.StompSubframeEncoder, classified as CWE-93 (Improper Neutralization of CRLF Sequences). The shouldEscape() method (lines 214–216) explicitly excludes CONNECT and CONNECTED commands from the escape routine to maintain STOMP 1.0 backward compatibility, but this also bypasses all newline validation. As a result, raw \n characters in header values are written directly to the wire buffer without sanitization, while other commands (e.g., SEND, SUBSCRIBE) correctly escape \n to \\n. The STOMP specification's intent was to skip the escape notation, not to permit raw newlines — Netty conflated escaping with validation. A public PoC (StompConnectHeaderInjectionPoC.java) has been published demonstrating the injection on Netty 4.2.12.Final (GitHub Advisory, Netty Security Advisory).

Successful exploitation allows an attacker with low privileges to inject additional STOMP headers into CONNECT frames, with high integrity impact and no confidentiality or availability impact (CVSS I:H, C:N, A:N). Practical consequences include authentication bypass (e.g., injecting admin-role:true), privilege escalation via header overwrite (e.g., injecting a second login:admin header that some brokers honor as the last value), and potential connection hijacking by overwriting the host header. The actual impact is broker-dependent: custom brokers trusting all received headers are most at risk, while RabbitMQ and ActiveMQ have partial mitigations depending on their plugin configurations (GitHub Advisory).

1. Identify target: Locate applications using io.netty:netty-codec-stomp (versions <= 4.2.15.Final or <= 4.1.135.Final) that act as STOMP proxies, WebSocket-STOMP bridges, or multi-tenant STOMP gateways where user-controlled input is placed into CONNECT frame header values.
2. Craft malicious input: Prepare a header value containing a raw newline followed by the desired injected header, e.g., password\nadmin-role:true for the passcode field, or user\nlogin:admin for the login field.
3. Submit input: Provide the crafted value through the application's input surface (e.g., a web form, API endpoint, or WebSocket message) that populates a CONNECT frame header.
4. Observe encoder behavior: The vulnerable StompSubframeEncoder.encodeHeaders() writes the raw \n to the output buffer without escaping, splitting the value into two separate header lines on the wire.
5. Broker processes injected header: The downstream STOMP broker (e.g., ActiveMQ, a custom broker) parses the injected line as a legitimate header. Depending on broker logic, this may grant elevated roles, overwrite the login header to escalate to an admin account, or redirect the connection via a spoofed host header.
6. Verify exploitation: Confirm the injected header was accepted by observing broker behavior (e.g., elevated session permissions, successful authentication as a different user) (GitHub Advisory, Netty Security Advisory).

• Network: STOMP CONNECT frames on the wire containing unexpected additional headers (e.g., admin-role, duplicate login, or unexpected host values) beyond the standard set; STOMP traffic with raw newline characters embedded within header values.
• Logs: Application logs showing STOMP CONNECT frames with more headers than expected; broker-side logs recording authentication events for users with elevated roles not explicitly granted; unexpected IllegalArgumentException after patching (indicating attempted injection post-fix).
• Process/Application Behavior: STOMP sessions authenticated with unexpected privilege levels; connections routed to unexpected broker hosts; duplicate header keys (e.g., two login: entries) in STOMP frame logs.

Upgrade to the patched versions: Netty 4.2.16.Final or Netty 4.1.136.Final, which add newline validation for CONNECT/CONNECTED frame headers, rejecting values containing raw \n or \r characters (Netty 4.2.16.Final Release, Netty 4.1.136.Final Release). As a workaround for applications that cannot immediately upgrade, implement application-level sanitization to strip or reject newline characters from any user-controlled input before it is placed into STOMP CONNECT frame header values. Multi-tenant STOMP gateways and WebSocket-STOMP bridges should be prioritized for patching given their higher exposure to untrusted user input (GitHub Advisory).

The advisory was published by Netty core maintainer normanmaurer on July 14, 2026, and the fix was included in the same release cycle as other security hardening changes (e.g., HTTP method/version control character rejection, MQTT UTF-8 validation). The advisory draws an explicit analogy to a prior Netty SMTP injection fix (GHSA-jq43-27x9-3v86), suggesting a pattern of protocol-level injection hardening across Netty codecs. No significant independent researcher commentary or broad media coverage has been identified at this time (GitHub Advisory).