CVE-2026-59920

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description Netty's STOMP encoder (StompSubframeEncoder) fails to escape or validate header values in CONNECT and CONNECTED frames. This occurs because the encoder intentionally skips escaping for these frames to comply with the STOMP 1.2 specification, but it does not reject raw newline ( ) characters. An attacker who can control a header value, such as a user-supplied login or passcode, can inject additional STOMP headers by inserting raw newlines. Since brokers parse each line as a separate header, this can allow an attacker to overwrite connection parameters or add authentication and role headers to bypass authentication or escalate privileges, depending on the broker implementation. The issue is specifically located in the encodeHeaders() and shouldEscape() functions.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later. As a temporary mitigation, restrict or sanitize user-supplied input used in STOMP CONNECT and CONNECTED frame headers to ensure no newline characters are present.