CVE-2026-59920 Netty: STOMP CONNECT Frame Header Injection
Attackers can inject STOMP headers via unescaped newlines in CONNECT frames, potentially bypassing authentication or escalating privileges in dependent brokers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59920?
CVE-2026-59920 is a medium-severity vulnerability in Netty Netty, published on 29 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Weakness: CWE-93
Which versions are affected by CVE-2026-59920?
4 open source packages ship an affected version, including io.netty:netty-codec-stomp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty-codec-stomp Maven | All versions | 4.1.136.Final |
io.netty:netty-codec-stomp Maven | All versions | 4.1.136.Final |
io.netty:netty-codec-stomp Maven | From 4.2.0.Final | 4.2.16.Final |
io.netty:netty-codec-stomp Maven | From 4.2.0.Final | 4.2.16.Final |
Products include Netty Netty.
How do I fix CVE-2026-59920?
Upgrade io.netty:netty-codec-stomp to a fixed version for your release line: 4.1.136.Final or 4.2.16.Final.
Is CVE-2026-59920 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59920 exists.
Other vulnerabilities in Netty Netty
- CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
- CVE-2026-75596 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
- CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
- CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
- CVE-2026-56745 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Sources
Also known as CLEANSTART-2026-AJ11768, CLEANSTART-2026-RY69809, DEBIAN-CVE-2026-59920, GHSA-3g8r-4pfx-jmfh, MINI-239w-wv4f-px8c, MINI-6cp6-8g86-4jjh and 9 more.