Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| netty | netty | affected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-3g8r-4pfx-jmfh | Netty: STOMP CONNECT Frame Header Injection in Netty |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 29 Jul 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the Netty STOMP (Streaming Text Oriented Messaging Protocol) decoder. This vulnerability allows a remote attacker to inject arbitrary protocol frames by crafting malformed STOMP commands that contain embedded carriage return (CR) and line feed (LF) sequences. This bypasses message boundary checks and can lead to command injection, potentially compromising the integrity of the system. | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final. |
| Title | io.netty/netty-codec-stomp: Netty: Improper CR/LF neutralization in netty-codec-stomp | Netty: STOMP CONNECT Frame Header Injection |
| References |
|
Tue, 28 Jul 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the Netty STOMP (Streaming Text Oriented Messaging Protocol) decoder. This vulnerability allows a remote attacker to inject arbitrary protocol frames by crafting malformed STOMP commands that contain embedded carriage return (CR) and line feed (LF) sequences. This bypasses message boundary checks and can lead to command injection, potentially compromising the integrity of the system. | |
| Title | io.netty/netty-codec-stomp: Netty: Improper CR/LF neutralization in netty-codec-stomp | |
| Weaknesses | CWE-93 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-07-29T17:32:46.835Z
Reserved: 2026-07-07T18:20:06.125Z
Link: CVE-2026-59920
Vulnrichment
No data.
NVD
No data.
Redhat
OpenCVE Enrichment
No data.
Weaknesses