CVE-2026-59920 netty CVE debrief

Who should care

Netty application developers, administrators, and users who utilize STOMP-based communication protocols should review and patch vulnerable versions to prevent potential authentication bypass or privilege escalation attacks. Additionally, security teams and vulnerability management teams should be aware of the potential impact on their systems and take necessary precautions.

Technical summary

Netty's STOMP encoder does not escape or validate header values in CONNECT and CONNECTED frames, allowing an attacker to inject additional STOMP headers and potentially bypass authentication or escalate privileges. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. This issue affects Netty versions prior to 4.1.136.Final and 4.2.16.Final. Netty application developers, administrators, and users who utilize STOMP-based communication protocols should review and patch vulnerable versions to prevent potential authentication bypass or privilege escalation attacks. Additionally, security teams and vulnerability management teams should be aware of the potential impact on their systems and take necessary precautions.

Defensive priority

Medium-priority defensive review recommended due to potential authentication bypass or privilege escalation in Netty applications.

Recommended defensive actions

• Review Netty application configurations and versions to identify potential exposure
• Verify STOMP encoder usage and validate header values
• Apply patches or updates to Netty versions 4.1.136.Final or 4.2.16.Final
• Monitor for suspicious activity or authentication attempts
• Consider implementing compensating controls for STOMP-based applications
• Perform a thorough review of affected product deployments in managed environments
• Track exceptions and retest remediated assets after verification

Evidence notes

Evidence from official CVE and NVD sources indicates a vulnerability in Netty's STOMP encoder. The CVE record and NVD entry provide details on the issue, but additional verification is recommended. Grounding from CVE.org and NVD suggests that Netty versions prior to 4.1.136.Final and 4.2.16.Final are affected. Defenders should verify STOMP encoder usage, validate header values, and review application configurations for potential exposure.

Official resources