CVE-2026-59919 Overview
CVE-2026-59919 is a CRLF injection vulnerability [CWE-93] in the Netty asynchronous network application framework. The flaw resides in the HAProxyMessageEncoder class, which writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for carriage return and line feed (CRLF) characters. An attacker who controls an AF_UNIX address can inject \r\n sequences and split a single PROXY header into multiple lines. The forged second PROXY line spoofs the client source or destination IP presented to a downstream server or load balancer. Netty versions prior to 4.1.136.Final and 4.2.16.Final are affected.
Critical Impact
Attackers can spoof upstream client IP addresses at downstream services, undermining IP-based access controls, logging, and rate-limiting decisions.
Affected Products
- Netty versions prior to 4.1.136.Final
- Netty 4.2.x versions prior to 4.2.16.Final
- Applications using HAProxyMessageEncoder with AF_UNIX PROXY protocol V1 output
Discovery Timeline
- 2026-07-29 - CVE-2026-59919 published to the National Vulnerability Database (NVD)
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-59919
Vulnerability Analysis
The HAProxy PROXY protocol V1 is a text-based format terminated with a CRLF (\r\n) sequence. Netty's HAProxyMessageEncoder serializes source and destination addresses directly into this text stream. For IPv4 and IPv6 addresses, format validation implicitly rejects CRLF because the parsers enforce strict numeric or hexadecimal formats. For AF_UNIX sockets, however, the encoder only validates the address length, permitting up to 108 bytes of arbitrary content, including CRLF bytes.
When an attacker-controlled AF_UNIX path contains \r\n, the encoder emits a payload that a downstream parser interprets as two separate PROXY header lines. The second forged line can present arbitrary IPv4 or IPv6 source and destination addresses. Downstream services then attribute the connection to the spoofed client, corrupting audit logs and bypassing IP allow-lists.
Root Cause
The root cause is missing input sanitization on AF_UNIX socket address strings before they are written into a CRLF-delimited text protocol. The encoder treats the length limit of 108 bytes as sufficient validation, ignoring the presence of protocol-significant control characters within that length.
Attack Vector
The attacker must control an AF_UNIX address that Netty passes to HAProxyMessageEncoder. This typically requires local access or influence over Unix domain socket paths used by a Netty-based proxy. The forged header then propagates over the network to downstream trust boundaries, allowing IP spoofing without requiring network-level attacker positioning.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-wh89-7897-x99h for authoritative technical details.
Detection Methods for CVE-2026-59919
Indicators of Compromise
- PROXY protocol V1 header bytes containing embedded \r\n sequences within AF_UNIX address fields on the wire
- Downstream logs showing multiple PROXY header lines on a single inbound connection
- Mismatches between the socket-level peer address and the client IP recorded by downstream services
Detection Strategies
- Inspect PROXY protocol V1 traffic for more than one PROXY line per client connection prior to the first non-PROXY byte
- Audit application inventories for Netty versions below 4.1.136.Final and 4.2.16.Final where HAProxyMessageEncoder is used
- Alert on AF_UNIX socket paths that contain non-printable or control characters, including 0x0D and 0x0A
Monitoring Recommendations
- Correlate reverse-proxy access logs with upstream Netty peer addresses to identify client IP inconsistencies
- Monitor process creation of services binding Unix domain sockets in locations writable by lower-privileged users
- Ingest Netty and downstream load balancer logs into a centralized data lake for cross-tier correlation
How to Mitigate CVE-2026-59919
Immediate Actions Required
- Upgrade Netty to 4.1.136.Final or 4.2.16.Final or later in all affected services
- Restrict who can create or control AF_UNIX socket paths passed into HAProxyMessageEncoder
- Review downstream trust configuration so PROXY protocol input from untrusted sources is rejected
Patch Information
The issue is fixed in Netty 4.1.136.Final and 4.2.16.Final. The patched encoder validates AF_UNIX addresses for CRLF characters before serialization. Refer to the GitHub Security Advisory GHSA-wh89-7897-x99h for the full changeset and version matrix.
Workarounds
- Use the PROXY protocol V2 binary encoder instead of V1 where feasible, as V2 is length-prefixed and not CRLF-delimited
- Reject or sanitize AF_UNIX addresses containing bytes 0x0D or 0x0A before invoking the encoder
- Terminate PROXY protocol at a trusted boundary and re-emit headers from a validated source
# Maven dependency upgrade example
mvn versions:use-dep-version -Dincludes=io.netty:netty-codec-haproxy -DdepVersion=4.1.136.Final -DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
