Listen to this Post
Netty is an asynchronous, event-driven network application framework widely used in high-performance network servers, proxies, and load balancers. The vulnerability identified as CVE-2026-59919 resides in the HAProxy protocol encoder component (HAProxyMessageEncoder), specifically within the `netty-codec-haproxy` module. This flaw enables a CRLF injection attack through the handling of AF_UNIX socket addresses in the HAProxy V1 text protocol.
The HAProxy V1 protocol uses CRLF (\r\n) sequences as line terminators to delimit PROXY header lines. When Netty encodes a PROXY header, it writes the source and destination socket addresses directly into the protocol stream. For IPv4 and IPv6 addresses, the encoder performs format validation that implicitly rejects CRLF characters because these address types have strict structural requirements (e.g., dots for IPv4, colons for IPv6). However, AF_UNIX addresses—which represent file system paths—are only validated for length, with a maximum of 108 bytes. No validation is performed to strip or reject control characters such as carriage return (\r) or line feed (\n).
An attacker who can control the AF_UNIX address value (for example, by supplying a malicious path through an API or configuration that feeds into the HAProxy encoder) can embed `\r\n` sequences within the address string. When the encoder writes this address into the PROXY header, the embedded CRLF splits the single header line into multiple lines. The downstream server or load balancer that parses these lines will interpret the second line as a new PROXY header, effectively allowing the attacker to spoof the client source IP address and destination IP address. This can lead to bypass of access controls, traffic misrouting, and impersonation of trusted clients.
The vulnerability affects all Netty versions prior to 4.1.136.Final and all versions in the 4.2.x line prior to 4.2.16.Final. The issue was addressed by introducing proper CRLF sanitization for AF_UNIX addresses in the encoder. The patches were released on July 6, 2026 (4.2.16.Final) and July 9, 2026 (4.1.136.Final). Organizations using Netty in proxy, load balancing, or any HAProxy protocol-facing capacity are strongly advised to upgrade immediately. The vulnerability is classified as High severity with a CVSS 3.1 score of 7.5, reflecting the network accessibility, low attack complexity, and high integrity impact without requiring privileges or user interaction.
DailyCVE Form:
Platform: Netty
Version: <4.1.136, <4.2.16
Vulnerability: CRLF Injection
Severity: High (7.5)
date: 2026-07-29
Prediction: 2026-07-09
Analytics under What Undercode Say:
The following commands and code snippets can be used to assess and remediate the vulnerability:
Check current Netty version in a Maven project mvn dependency:tree | grep netty-codec-haproxy Check current Netty version in a Gradle project gradle dependencies | grep netty-codec-haproxy Upgrade to fixed version in Maven pom.xml <dependency> <groupId>io.netty</groupId> <artifactId>netty-codec-haproxy</artifactId> <version>4.1.136.Final</version> <!-- or 4.2.16.Final for 4.2.x line --> </dependency> Upgrade in Gradle build.gradle implementation 'io.netty:netty-codec-haproxy:4.1.136.Final' or implementation 'io.netty:netty-codec-haproxy:4.2.16.Final'
Vulnerable Code Pattern (before fix):
// HAProxyMessageEncoder.encodeV1() - vulnerable logic
StringBuilder buf = new StringBuilder()
.append("PROXY ")
.append(msg.proxiedProtocol().name())
.append(' ')
.append(msg.sourceAddress()) // AF_UNIX address with CRLF not sanitized
.append(' ')
.append(msg.destinationAddress())
.append("\r\n");
Exploit:
An attacker can craft an AF_UNIX address such as /tmp/socket\r\nPROXY TCP4 1.2.3.4 5.6.7.8 1234 5678\r\n. When this address is passed to the encoder, the resulting PROXY header becomes:
PROXY UNKNOWN /tmp/socket PROXY TCP4 1.2.3.4 5.6.7.8 1234 5678
The downstream server receives two PROXY headers and will process the second one, believing the client is `1.2.3.4` instead of the actual source. This allows an attacker to spoof arbitrary IP addresses, bypassing IP-based authentication, access controls, and logging mechanisms that rely on the PROXY protocol.
Protection:
- Upgrade to Netty version 4.1.136.Final or 4.2.16.Final immediately.
- If immediate upgrade is not possible, apply a patch that sanitizes AF_UNIX addresses by removing or rejecting CRLF characters before encoding.
- Validate and sanitize all user-supplied input that may influence AF_UNIX addresses before they reach the HAProxy encoder.
- Deploy network-level detection rules to monitor for PROXY headers containing multiple CRLF sequences, which may indicate exploitation attempts.
- Consider using the HAProxy V2 protocol, which uses a binary format and is not susceptible to this CRLF injection issue, if feasible.
Impact:
- Client IP Spoofing: Attackers can forge the source IP address seen by downstream servers, enabling impersonation of trusted clients.
- Bypass of Security Controls: IP-based authentication, rate limiting, and access control lists (ACLs) that rely on the PROXY-provided source IP can be circumvented.
- Traffic Misrouting: Load balancers and proxies may route traffic based on spoofed destination addresses, leading to denial of service or redirection to malicious endpoints.
- Log Forgery: Security logs and audit trails that record client IPs from the PROXY header will contain false information, hindering incident response and forensic analysis.
- Widespread Exposure: Any application using Netty’s HAProxy encoder in a proxy or load-balancing context is vulnerable, making this a critical concern for cloud-native and microservices architectures.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
