Listen to this Post
CVE-2026-59920 details a critical vulnerability in Netty’s STOMP implementation.
Netty is a widely-used asynchronous event-driven network application framework.
The flaw resides in the StompSubframeEncoder class, specifically in encoding CONNECT and CONNECTED frames.
Per the STOMP 1.2 specification, certain frames may skip escaping for performance, but Netty’s encoder mishandles this.
The encoder writes header values directly to the wire without validating or escaping newline characters (\n or \r\n).
In STOMP, headers are separated by newlines; each line corresponds to a key:value pair.
An attacker who can control a header value, such as the ‘login’ or ‘passcode’ field in a CONNECT frame, can inject a newline.
This injected newline terminates the current header and allows appending arbitrary additional headers.
For example, injecting ‘\nrole:admin’ after the login value would add a role header.
The broker (e.g., RabbitMQ, ActiveMQ Artemis) parses the frame line-by-line and processes all headers.
This enables the attacker to overwrite critical connection parameters like ‘login’ and ‘passcode’.
Alternatively, the attacker can inject authentication-related headers such as ‘x-role’ or ‘authorization’.
The impact is entirely broker-dependent; some brokers treat the last occurrence of a header as authoritative.
Others may merge headers, but injecting a new ‘login’ header can change the authenticated user.
Privilege escalation occurs if the attacker injects a role with administrative permissions.
The vulnerability exists because the encoder intentionally skips escaping for CONNECT/CONNECTED frames based on the spec.
However, the spec does not mandate accepting raw newlines; it requires rejection or proper encoding.
Netty’s implementation fails to reject such control characters, leading to a classic HTTP request smuggling-style attack.
The attack requires the attacker to be able to supply arbitrary input to the header value, e.g., via user-supplied credentials.
No authentication is needed to exploit; the attack is pre-authentication in the STOMP handshake.
The fixed versions (4.1.136.Final and 4.2.16.Final) add a validation layer that throws an exception or escapes newlines.
Specifically, the encoder now sanitizes header values by rejecting or encoding newline characters.
The CVSS score is likely high due to low complexity and network accessibility.
NVD published this on July 29, 2026, and updated on August 6, 2026.
Affected applications include any service using Netty with STOMP and relying on broker authentication.
This includes chat servers, messaging gateways, and IoT backends.
The exploit is trivial to implement using a simple STOMP client or raw socket.
Defensive measures must focus on input validation and immediate version upgrades.
This vulnerability underscores the danger of implicit trust in protocol specifications.
Mitigation requires both application-level filtering and framework-level patching.
DailyCVE Form:
Platform: Netty Framework
Version: <4.1.136.Final
Vulnerability: STOMP Header Injection
Severity: Critical
date: 2026-07-29
Prediction: Already Patched Release
What Undercode Say:
Analytics – run these bash commands to detect vulnerable deployments:
– `mvn dependency:tree | grep -i netty | grep -E ‘4\.1\.[0-9]|4\.2\.[0-9]’`
– `gradle dependencies | grep netty | grep -E ‘4\.1\.[0-9]+|4\.2\.[0-9]+’`
– `find /opt/apps -name “netty-.jar” -exec basename {} \; | sort -V`
– `java -cp netty-all.jar io.netty.util.Version | head -1`
– `curl -s http://target:8080/actuator/info | jq ‘.versions.netty’`
– `grep -r “StompSubframeEncoder” /libs/ && echo “VULNERABLE_COMPONENT_PRESENT”`
– `python3 -c “import pkg_resources; print(pkg_resources.get_distribution(‘netty’).version)”`
Exploit:
Send a crafted STOMP CONNECT frame with newline injection using netcat:
echo -e "CONNECT\nlogin:attacker\npasscode:anything\nrole:admin\n\n\x00" | nc -v target-broker 61613
Python snippet for raw socket injection:
import socket
s=socket.create_connection(('broker',61613))
payload="CONNECT\nlogin:user\npasscode:pass\nx-role:superuser\n\n\x00"
s.send(payload.encode()); print(s.recv(1024))
Protection:
- Upgrade to netty-4.1.136.Final or 4.2.16.Final immediately.
- If upgrade impossible, implement a custom ChannelInboundHandler that intercepts ByteBuf and strips/rejects newline characters in STOMP headers before encoding.
- Deploy a reverse proxy (e.g., HAProxy) with a rule to drop frames containing `\n[^:]+:` patterns in the CONNECT payload.
- Enforce application-level validation on all user-supplied login/passcode fields to reject multi-line strings.
Impact:
Successful exploitation allows an unauthenticated attacker to inject arbitrary STOMP headers, overwrite connection credentials, escalate privileges to administrative roles, and gain full control over the message broker—leading to unauthorized message consumption, publication, queue manipulation, and potential lateral movement within the infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
