HTTP Request Smuggling Affecting io.netty:netty-codec-http package, versions [ ,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IONETTY-18233107
- published23 Jul 2026
- disclosed22 Jul 2026
- creditUnknown
Introduced: 22 Jul 2026
NewCVE-2026-59898 (opens in a new tab)How to fix?
Upgrade io.netty:netty-codec-http to version 4.1.136.Final, 4.2.16.Final or higher.
Overview
io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.
Affected versions of this package are vulnerable to HTTP Request Smuggling in the WebSocket handshake. An attacker can bypass expected header validation by sending a Sec-WebSocket-Version: 7 header while omitting the Connection: Upgrade and Upgrade: websocket headers, which may result in a protocol switch that is not recognized by intermediary proxies, potentially enabling HTTP request smuggling or protocol confusion attacks.