CVE-2026-59898: netty HTTP Request/Response Smuggling

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2026-59898DEBIAN-CVE-2026-59898CGA-235r-v88q-hwwv+840 more

Published 29-07-2026Last modified 30-07-2026

Vulnerability summary

CVE-2026-59898 is a high (CVSS 7.5) HTTP Request/Response Smuggling vulnerability in netty. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

0.44%

0%100%

Low · +0.19 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3

OPENSUSE-SU-2026:11394-1 SUSE-SU-2026:3482-1 CGA-P4VM-5RM3-GW26

Timeline

29-07-2026
PublishedVulnerability first disclosed.
30-07-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS metrics

9 scores · 7 sources · 2 versions

v4.06.3v3.17.5

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

+0.19 pp

From 0.25% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Chainguard200 products

airbyte-server< 2.0.0-r8
airbyte-server-fips< 2.0.0-r10
akhq< 0.27.1-r12
apache-activemq-artemis< 2.55.0-r1
apache-camel-karavan-devmode< 4.18.1-r8

apache-hop< 2.18.1-r10
apache-hop-fips< 2.18.1-r6
apache-nifi< 2.10.0-r6
apache-pulsar-4.0< 4.0.12-r2
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.3-r3
apache-pulsar-fips-4.0< 4.0.12-r2
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.3-r2
apicurio-registry< 3.3.0-r11
apicurio-registry-3-operator< 3.3.0-r11
apicurio-registry-3-operator-fips< 3.3.0-r8
apicurio-registry-fips< 3.3.0-r8
camunda-8.8< 8.8.31-r2
camunda-8.9< 8.9.13-r2
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.35-r1
camunda-zeebe-8.8< 8.8.32-r1
camunda-zeebe-8.9< 8.9.13-r1
celeborn-0.5All versions (No fix recorded) | < 0.5.4-r32
celeborn-0.6All versions (No fix recorded) | < 0.6.3-r13
celeborn-0.7< 0.7.0-r5 | < 0.7.0-r3
cloudwatch-exporter< 0.18.0-r5 | < 0.18.0-r1
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.22-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.8-r0
commercial-elasticsearch-9.5< 9.5.5-r0
conductor< 3.31.0-r5
conductor-fips< 3.31.0-r6
druid< 37.0.0-r45 | < 37.0.0-r56
elasticsearch-8.19< 8.19.19-r1
elasticsearch-8.19-iamguarded< 8.19.19-r1
elasticsearch-8.19-iamguarded-fips< 8.19.19-r1
elasticsearch-9.1All versions (No fix recorded)
elasticsearch-9.1-iamguardedAll versions (No fix recorded)
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2< 9.2.8-r12
elasticsearch-9.2-iamguarded< 9.2.8-r12
elasticsearch-9.2-iamguarded-fips< 9.2.8-r12
elasticsearch-9.3< 9.3.8-r5
elasticsearch-9.3-iamguarded< 9.3.8-r5
elasticsearch-9.3-iamguarded-fips< 9.3.7-r9
elasticsearch-9.4< 9.4.5-r2
elasticsearch-9.4-iamguarded< 9.4.5-r2
elasticsearch-9.4-iamguarded-fips< 9.4.5-r3
elasticsearch-9.5< 9.5.1-r2
elasticsearch-9.5-iamguarded< 9.5.1-r2
elasticsearch-9.5-iamguarded-fips< 9.5.2-r2
elasticsearch-fips-8.19< 8.19.19-r1
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2< 9.2.8-r12
elasticsearch-fips-9.3< 9.3.7-r9
elasticsearch-fips-9.4< 9.4.5-r3
elasticsearch-fips-9.5< 9.5.2-r2
floci< 1.5.33-r3
floci-az< 0.9.0-r3
flyway< 13.0.0-r1
flyway-fips< 13.0.0-r3
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r7
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded) | < 3.5.0-r14 | < 3.5.0-r3
hono-adapter-mqtt< 2.7.0-r29
hono-cli< 2.7.0-r29
hono-service-auth< 2.7.0-r29
hono-service-command-router< 2.7.0-r29
hono-service-device-registry-jdbc< 2.7.0-r29
infinispan-15.0< 15.0.22-r14
infinispan-15.1< 15.1.7-r25
infinispan-15.2< 15.2.6-r23
infinispan-16.0< 16.0.14-r2
infinispan-16.1< 16.1.4-r7
infinispan-16.2< 16.2.1-r2
kafbat-ui< 1.5.0-r10
kafbat-ui-fips< 1.5.0-r6
kafka_exporter-strimzi-compat< 1.2.0-r5 | < 1.2.0-r4
kafka-bridge< 1.0.0-r9
kafka-bridge-fips< 1.0.0-r6
kafka-strimzi-compat< 1.2.0-r5 | All versions (No fix recorded)
kayenta-2025.2< 2025.2.4-r6
kayenta-2025.4< 2025.4.6-r11
kayenta-2026.0< 2026.0.4-r17
kayenta-2026.1< 2026.1.2-r1
kayenta-fips-2025.2< 2025.2.4-r7
kayenta-fips-2025.4< 2025.4.6-r6
kayenta-fips-2026.0< 2026.0.4-r11
kayenta-fips-2026.1< 2026.1.2-r1
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.4-r24
keycloak-26.6-iamguarded-compat< 26.6.4-r24
keycloak-26.6-operator< 26.6.4-r24
keycloak-26.7< 26.7.0-r4
keycloak-26.7-iamguarded-compat< 26.7.0-r4
keycloak-26.7-operator< 26.7.0-r4
keycloak-fips-26.5< 26.5.7-r10
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r10
keycloak-fips-26.5-operator< 26.5.7-r10
keycloak-fips-26.6< 26.6.4-r10
keycloak-fips-26.6-iamguarded-fips< 26.6.4-r10
keycloak-fips-26.6-operator< 26.6.4-r10
keycloak-fips-26.7< 26.7.0-r3
keycloak-fips-26.7-iamguarded-fips< 26.7.0-r3
keycloak-fips-26.7-operator< 26.7.0-r3
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r12
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r12
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r14
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r14
knative-kafka-broker-1.22-dispatcher-loom< 1.22.2-r8
knative-kafka-broker-1.22-receiver-loom< 1.22.2-r8
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r10
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r10
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.4-r9
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.4-r9
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.2-r11
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.2-r11
kserve-modelmesh< 0.12.0-r38
localstack< 4.14.0-r20
logstash-8.19< 8.19.19-r3
logstash-8.19-iamguarded-compat< 8.19.19-r3
logstash-8.19-with-output-opensearch< 8.19.19-r3
logstash-9.2< 9.2.8-r6
logstash-9.2-iamguarded-compat< 9.2.8-r6
logstash-9.2-with-output-opensearch< 9.2.8-r6
logstash-9.3All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded)
logstash-9.4< 9.4.4-r3
logstash-9.4-iamguarded-compat< 9.4.4-r3
logstash-fips-9.4< 9.4.4-r1
logstash-fips-9.4-iamguarded-compat< 9.4.4-r1
management-api-for-apache-cassandra-5.0< 0.1.122-r2
metabase< 0.63.2-r3
neo4j-2025.12All versions (No fix recorded)
neo4j-2026.01All versions (No fix recorded)
neo4j-2026.02< 2026.02.3-r4
neo4j-2026.03< 2026.03.1-r4
neo4j-2026.04< 2026.04.0-r3
neo4j-2026.05< 2026.05.0-r12
neo4j-2026.05-docker-publishAll versions (No fix recorded)
neo4j-2026.06< 2026.06.0-r4
neo4j-5.26< 5.26.28-r6
nuxeo-2023< 2023.45-r3
opensearch-2< 2.19.6-r6
opensearch-2-ml-commons< 2.19.6-r6
opensearch-2-performance-analyzer< 2.19.6-r6
opensearch-2-repository-azure< 2.19.6-r6
opensearch-2-repository-s3< 2.19.6-r6
opensearch-2-security< 2.19.6-r6
opensearch-2-transport-nio< 2.19.6-r6
opensearch-3< 3.7.0-r5
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-ml-commons< 3.7.0-r5
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.7.0-r5
opensearch-3-performance-analyzer< 3.7.0-r5
opensearch-3-repository-azure< 3.7.0-r5
opensearch-3-repository-s3< 3.7.0-r5
opensearch-3-security< 3.7.0-r5
opensearch-3-security-analytics< 3.8.0-r2
opensearch-fips-3< 3.7.0-r5
opensearch-fips-3-ml-commons< 3.7.0-r5
opensearch-fips-3-notifications< 3.7.0-r5
opensearch-fips-3-performance-analyzer< 3.7.0-r5
opensearch-fips-3-repository-azure< 3.7.0-r5
opensearch-fips-3-repository-s3< 3.7.0-r5
opensearch-fips-3-security< 3.7.0-r5
opensearch-fips-3-security-analytics< 3.8.0-r2
pinot< 1.5.1-r6
pinot-fips< 1.5.1-r6
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r7
request-9047-keycloak-fips-26.4< 26.4.7-r23
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r23
request-9047-keycloak-fips-26.4-operator< 26.4.7-r23
request-9047-keycloak-fips-26.5< 26.5.7-r15
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r15
request-9047-keycloak-fips-26.5-operator< 26.5.7-r15
request-9047-keycloak-fips-26.6< 26.6.4-r5
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.4-r5
request-9047-keycloak-fips-26.6-operator< 26.6.4-r5
s3proxy< 3.3.0-r6
s3proxy-fips< 3.3.0-r5
seata-server< 2.7.0-r3
sonarqubeAll versions (No fix recorded)
spark-3.5-scala-2.12< 3.5.9-r2
spark-3.5-scala-2.13< 3.5.9-r2
spark-4.0-scala-2.13< 4.0.4-r1
spark-4.1-scala-2.13< 4.1.3-r2

Show all 200

1 vendor · 200 products · Showing 200 of 307. Use Open JSON for the complete list.

References

9 links

github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hgX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/netty/netty/releases/tag/netty-4.1.136.FinalX Refsource MISCWEBRelease Notes
github.com/netty/netty/releases/tag/netty-4.2.16.FinalX Refsource MISCWEBRelease Notes
ubuntu.com/security/CVE-2026-59898REPORT
www.cve.org/CVERecord?id=CVE-2026-59898REPORT
security-tracker.debian.org/tracker/CVE-2026-59898Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59898.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-59898Advisory
github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities