What is GHSA-4mp9-239f-g9hg?

GHSA-4mp9-239f-g9hg is a security advisory published by GitHub Security Advisories with Medium severity. Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Which CVE IDs does GHSA-4mp9-239f-g9hg cover?

GHSA-4mp9-239f-g9hg covers the following CVE IDs: CVE-2026-59898. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-4mp9-239f-g9hg?

GHSA-4mp9-239f-g9hg affects 2 products, including: maven/io.netty:netty-codec-http:\u003e= 4.2.0.Final, \u003c= 4.2.15.Final; maven/io.netty:netty-codec-http:\u003c 4.1.136.Final.

GHSA-4mp9-239f-g9hgMedium

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Vendor

GitHub Security Advisories

Published

July 22, 2026

Last Modified

July 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-59898 →

📋 Description

Summary

An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks.

🎯 Affected products2

maven/io.netty:netty-codec-http:>= 4.2.0.Final, <= 4.2.15.Final
maven/io.netty:netty-codec-http:< 4.1.136.Final

🔗 References (4)

https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg
https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
https://github.com/advisories/GHSA-4mp9-239f-g9hg