CVE-2026-59920

Netty CVE-2026-59920 concerns the STOMP framing path: the STOMP encoder StompSubframeEncoder intentionally does not escape header values for CONNECT and CONNECTED frames, allowing raw newline characters to be written to the wire. This creates a header-injection risk, because a header value contai...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +914 more potentially affected by CVE-2026-59920 via io.netty:netty-codec-stomp (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-stomp MAVEN version =4.2.0.final, =4.2.15.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-stomp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

CVE-2026-59920 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +914 more potentially affected by CVE-2026-59920 via io.netty:netty-codec-stomp (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-stomp MAVEN version =4.2.0.final, =4.2.15.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-stomp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +914 more potentially affected by CVE-2026-59920 via io.netty:netty-codec-stomp (>=4.2.0.final, <=4.2.15.final)

io.netty:netty-codec-stomp MAVEN version =4.2.0.final, =4.2.15.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-stomp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4651 more potentially affected by CVE-2026-59920 via io.netty:netty-codec-stomp (>=4.1.0.beta1, <=4.1.135.final)

io.netty:netty-codec-stomp MAVEN version =4.1.0.beta1, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cve...