CVE-2026-59898: 
Java Análisis y mitigación de vulnerabilidades

CVE-2026-59898 is an HTTP request smuggling vulnerability in Netty's WebSocket V07/V08 handshaker, titled "WebSockets V07/V08 handshaker missing Connection/Upgrade validation." The flaw affects the io.netty:netty-codec-http Maven package in all versions prior to 4.1.136.Final and versions 4.2.0.Final through 4.2.15.Final. It was published to the GitHub Advisory Database on July 22, 2026, with patches released on July 7–9, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, Netty Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). The Netty V07 and V08 WebSocket handshakers fail to enforce the presence of mandatory Connection: Upgrade and Upgrade: websocket HTTP headers during the WebSocket upgrade handshake. An attacker can craft a request containing only Sec-WebSocket-Version: 7 (or 8) while omitting these required headers, causing Netty to complete the protocol switch to WebSocket. Because the request lacks the standard upgrade headers, an intermediary proxy does not recognize it as an upgrade request, creating a desynchronization between the proxy and the backend server that enables HTTP request smuggling and protocol-confusion attacks (Github Advisory, Netty Advisory).

Successful exploitation allows an unauthenticated remote attacker to inject and smuggle arbitrary HTTP requests through proxy intermediaries that are unaware of the protocol switch. This can lead to cache poisoning, session hijacking, unauthorized access to backend resources, and bypassing of proxy-enforced security controls. While direct confidentiality and availability impacts on the vulnerable system are limited, the integrity of subsequent systems and session data is at risk, and the attack can facilitate lateral movement to backend services (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of writing. The NVD SSVC assessment indicates exploitation is "none" and the attack is not automatable. The EPSS score is approximately 0.27% (16th percentile), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus plugin 332130 (Github Advisory).

1. Reconnaissance: Identify targets running Netty-based applications (e.g., services using io.netty:netty-codec-http < 4.1.136.Final or 4.2.0.Final–4.2.15.Final) that are deployed behind a reverse proxy or load balancer.
2. Craft malformed upgrade request: Construct an HTTP request that includes the Sec-WebSocket-Version: 7 (or 8) header but deliberately omits the Connection: Upgrade and Upgrade: websocket headers.
3. Send request to target: Transmit the crafted request to the Netty server through the proxy. The proxy, not seeing standard upgrade headers, treats it as a regular HTTP request and forwards it.
4. Trigger protocol switch: Netty's lax V07/V08 handshaker accepts the request and completes the WebSocket protocol upgrade, creating a desynchronization between the proxy and the backend.
5. Smuggle subsequent requests: Exploit the desynchronized connection state to inject additional HTTP requests that the proxy attributes to other users or sessions, potentially accessing protected resources or poisoning shared caches (Github Advisory, Netty Advisory).

• Network: HTTP requests to WebSocket endpoints containing Sec-WebSocket-Version: 7 or Sec-WebSocket-Version: 8 headers but lacking Connection: Upgrade and/or Upgrade: websocket headers; unexpected WebSocket connections established without standard upgrade handshake headers visible in proxy logs.
• Logs: Proxy access logs showing HTTP requests forwarded to backend without upgrade headers that result in a 101 Switching Protocols response from the backend; discrepancies between proxy-recorded request counts and backend-recorded request counts on the same connection.
• Application: Unexpected or unauthorized requests appearing in backend application logs that do not correspond to requests logged by the proxy, indicating request smuggling activity.

Upgrade to Netty 4.1.136.Final or 4.2.16.Final, which enforce strict validation of Connection: Upgrade and Upgrade: websocket headers in the V07/V08 WebSocket handshakers. No configuration-based workaround is documented; patching is the only reliable remediation. Downstream products such as IBM App Connect for Manufacturing and Red Hat products have also released security updates addressing this issue (Netty 4.1.136.Final Release, Netty 4.2.16.Final Release, Github Advisory).

The vulnerability was disclosed by Netty maintainer normanmaurer via the GitHub Security Advisory program. Red Hat issued errata (RHSA-2026:47189 and RHSA-2026:47172) addressing the issue in affected products, and IBM published a security bulletin for IBM App Connect for Manufacturing. SUSE also released a security update (SUSE-SU-2026:3482-1). The Quarkus project addressed the issue in its 3.33.3 release. Community reaction has been measured, consistent with the moderate severity rating and absence of active exploitation.