130 lines
5.6 KiB
JSON
130 lines
5.6 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-59920",
|
||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "GitHub_M",
|
||
"dateReserved": "2026-07-07T18:20:06.125Z",
|
||
"datePublished": "2026-07-29T17:32:46.835Z",
|
||
"dateUpdated": "2026-07-29T19:24:41.740Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"title": "Netty: STOMP CONNECT Frame Header Injection",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-93",
|
||
"lang": "en",
|
||
"description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "NONE",
|
||
"baseScore": 6.5,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
|
||
"version": "3.1"
|
||
}
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"name": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh",
|
||
"tags": [
|
||
"x_refsource_CONFIRM"
|
||
],
|
||
"url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "netty",
|
||
"product": "netty",
|
||
"versions": [
|
||
{
|
||
"version": "< 4.1.136.Final",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": ">= 4.2.0.Final, < 4.2.16.Final",
|
||
"status": "affected"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"shortName": "GitHub_M",
|
||
"dateUpdated": "2026-07-29T17:32:46.835Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \\n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final."
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "GHSA-3g8r-4pfx-jmfh",
|
||
"discovery": "UNKNOWN"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"references": [
|
||
{
|
||
"url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh",
|
||
"tags": [
|
||
"exploit"
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-07-29T19:01:13.468486Z",
|
||
"id": "CVE-2026-59920",
|
||
"options": [
|
||
{
|
||
"Exploitation": "poc"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-07-29T19:24:41.740Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |