CVE-2026-59898: 
Java vulnerability analysis and mitigation

CVE-2026-59898 is an HTTP request smuggling vulnerability in Netty's WebSocket V07/V08 handshaker implementation, caused by missing validation of Connection: Upgrade and Upgrade: websocket headers. An unauthenticated remote attacker can force a WebSocket protocol upgrade by sending only Sec-WebSocket-Version: 7 while omitting the required upgrade headers, completing a protocol switch that intermediary proxies will not recognize as a legitimate upgrade request. The vulnerability affects io.netty:netty-codec-http versions >= 4.2.0.Final through <= 4.2.15.Final and all versions < 4.1.136.Final. It was published by Netty maintainer normanmaurer on July 14, 2026, and added to the GitHub Advisory Database on July 22, 2026. The CVSS v4.0 base score is 6.3 (Medium) (GitHub Advisory, Netty Advisory).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). Netty's V07 and V08 WebSocket handshakers do not enforce the presence of the mandatory Connection: Upgrade and Upgrade: websocket HTTP headers before completing a protocol switch. An attacker can craft an HTTP request containing only the Sec-WebSocket-Version: 7 header, which the lax handshaker accepts as sufficient to initiate a WebSocket upgrade. Because the request lacks the standard upgrade indicators, any intermediary proxy in the request path will not interpret it as an upgrade request and will continue treating the connection as plain HTTP, creating a protocol-confusion condition that enables HTTP request smuggling attacks (GitHub Advisory, Netty Advisory).

Successful exploitation enables HTTP request smuggling and protocol-confusion attacks against backend systems sitting behind proxies or load balancers. While the vulnerable Netty system itself has no direct confidentiality, integrity, or availability impact, subsequent systems can suffer low-level confidentiality and integrity compromise — for example, attackers may be able to poison shared connection state, hijack other users' sessions, bypass proxy-enforced access controls, or inject malicious requests into backend HTTP pipelines. The attack requires no privileges and no user interaction, making it accessible to any network-adjacent attacker (GitHub Advisory).

1. Reconnaissance: Identify applications using Netty's io.netty:netty-codec-http library (versions < 4.1.136.Final or 4.2.0.Final–4.2.15.Final) that expose WebSocket endpoints and sit behind a proxy or load balancer.
2. Craft malicious HTTP request: Construct an HTTP request targeting a WebSocket endpoint that includes the Sec-WebSocket-Version: 7 header but deliberately omits the Connection: Upgrade and Upgrade: websocket headers.
3. Send request through proxy: Transmit the crafted request through the intermediary proxy. The proxy, seeing no standard upgrade headers, treats the connection as a normal HTTP request and does not apply WebSocket-specific handling or security controls.
4. Trigger lax handshake: The Netty V07/V08 handshaker on the backend accepts the incomplete upgrade request and completes the protocol switch to WebSocket, creating a desynchronized state between the proxy and the backend server.
5. Exploit protocol confusion: Leverage the desynchronized connection state to inject smuggled HTTP requests, potentially bypassing proxy-enforced access controls, poisoning shared connection queues, or hijacking other users' requests processed through the same backend connection (GitHub Advisory).

• Network: HTTP requests to WebSocket endpoints containing Sec-WebSocket-Version: 7 (or 8) header but lacking Connection: Upgrade and/or Upgrade: websocket headers; unexpected protocol switches on connections that proxies log as standard HTTP.
• Logs: Proxy access logs showing HTTP 101 Switching Protocols responses for requests that did not include standard upgrade headers; backend server logs recording WebSocket handshake completions on connections the proxy did not flag as upgrade requests.
• Application Behavior: Anomalous request routing or unexpected responses delivered to users sharing backend connections; session data appearing in responses for unrelated users, indicating request queue poisoning.

Netty has released patched versions that enforce strict validation of Connection: Upgrade and Upgrade: websocket headers in the V07/V08 WebSocket handshakers. Users should upgrade io.netty:netty-codec-http to 4.1.136.Final (for the 4.1.x branch) or 4.2.16.Final (for the 4.2.x branch). No configuration-based workaround is documented; upgrading to a patched version is the recommended remediation. As an interim measure, deploying a proxy or WAF that strictly validates WebSocket upgrade headers before forwarding requests to the backend may reduce exposure (Netty 4.1.136 Release, Netty 4.2.16 Release, GitHub Advisory).