CVE-2026-59898: netty, друго

Описание

Оригинално описание

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Засегнати продукти

• netty netty: >=4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final

Вид слабост

• CWE-444 Непоследователно интерпретиране на HTTP заявки

История

Други уязвимости в netty netty

• 7.3CVE-2026-100666
• 8.7CVE-2026-100665
• 8.7CVE-2026-100664
• 8.7CVE-2026-100663
• 8.7CVE-2026-100661

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-59898
• https://nvd.nist.gov/vuln/detail/CVE-2026-59898
• https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final