PT-2026-63550 · Netty · Netty
CVE-2026-59919
·
Published
2026-07-07
·
Updated
2026-07-22
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Netty versions prior to 4.2.12.Final
Description
Netty contains an issue where CRLF (Carriage Return Line Feed) sequences are not properly neutralized in the HAProxy V1 protocol implementation. Specifically, the
io.netty.handler.codec.haproxy.HAProxyMessageEncoder writes AF UNIX socket addresses directly into the output without validating them for CRLF characters. While IPv4 and IPv6 addresses are validated, AF UNIX addresses only undergo a length check in the checkAddress() function of the io.netty.handler.codec.haproxy.HAProxyMessage class.Because the V1 protocol uses CRLF as a line terminator, an attacker can inject CRLF characters into an AF UNIX address to split a single PROXY header into multiple lines. This allows for the injection of a second PROXY protocol header, which can be used to perform client IP spoofing by misleading the backend server about the origin of the connection.
Recommendations
Update Netty to version 4.2.12.Final or later.
As a temporary mitigation, restrict the use of AF UNIX addresses that contain user-controlled input when using the
io.netty.handler.codec.haproxy.HAProxyMessageEncoder.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Netty