CRLF Injection Affecting io.netty:netty-codec-stomp package, versions [,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IONETTY-18233126
- published23 Jul 2026
- disclosed22 Jul 2026
- creditUnknown
Introduced: 22 Jul 2026
NewCVE-2026-59920 (opens in a new tab)How to fix?
Upgrade io.netty:netty-codec-stomp to version 4.1.136.Final, 4.2.16.Final or higher.
Overview
Affected versions of this package are vulnerable to CRLF Injection via the encodeHeaders in the STOMP frame encoder, which fails to validate or escape newline characters in header values for certain commands. An attacker can inject arbitrary headers by including newline characters in user-controlled input, potentially bypassing authentication or modifying connection parameters.
Note: This is only exploitable if user-controlled input is placed into header values of a CONNECT or CONNECTED frame, the application does not perform its own newline sanitization, and the downstream STOMP broker processes the injected headers.