OR
          *cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions up to (excluding) 4.1.136
          *cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* versions from (including) 4.2.0 up to (excluding) 4.2.16

CISA-ADP: https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh Types: Mitigation, Vendor Advisory

GitHub, Inc.: https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh Types: Mitigation, Vendor Advisory

https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh

{"timestamp":"2026-07-29T19:01:13.468486Z","id":"CVE-2026-59920","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in  CONNECT  and  CONNECTED  frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-93

https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh

[{"vendor":"netty","product":"netty","versions":[{"version":"< 4.1.136.Final","status":"affected"},{"version":">= 4.2.0.Final, < 4.2.16.Final","status":"affected"}]}]