CVE details
CVE-2026-59920
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| java/netty | netty | 4.1.53_2 | unaddressed | glewis@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>netty</name>
<range><lt>4.1.136</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Netty is an asynchronous, event-driven network application framework.
In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP
encoder ( StompSubframeEncoder ) does not escape or validate header
values in CONNECT and CONNECTED frames, so raw newline
( \n ) characters in a header value are written directly to the
wire, allowing an attacker who controls a header value to inject
additional STOMP headers. This happens because the encoder
intentionally skips escaping for CONNECT/CONNECTED frames per the
STOMP 1.2 specification but never rejects the raw newlines, and since
a broker parses each line as a separate header, an attacker
controlling a value such as a user-supplied login or passcode can
overwrite connection parameters or add authentication/role headers to
bypass authentication or escalate privileges (the actual impact is
broker-dependent). The issue is fixed in versions 4.1.136.Final and
4.2.16.Final.</p>
</body>
</description>
<references>
<cvename>CVE-2026-59920</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-59920</url>
</references>
<dates>
<discovery>2026-07-29</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>