CVE-2026-59919

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.2.12.Final

Description Netty contains an issue where CRLF (Carriage Return Line Feed) sequences are not properly neutralized in the HAProxy V1 protocol implementation. Specifically, the io.netty.handler.codec.haproxy.HAProxyMessageEncoder writes AF UNIX socket addresses directly into the output without validating them for CRLF characters. While IPv4 and IPv6 addresses are validated, AF UNIX addresses only undergo a length check in the checkAddress() function of the io.netty.handler.codec.haproxy.HAProxyMessage class.

Because the V1 protocol uses CRLF as a line terminator, an attacker can inject CRLF characters into an AF UNIX address to split a single PROXY header into multiple lines. This allows for the injection of a second PROXY protocol header, which can be used to perform client IP spoofing by misleading the backend server about the origin of the connection.

Recommendations Update Netty to version 4.2.12.Final or later. As a temporary mitigation, restrict the use of AF UNIX addresses that contain user-controlled input when using the io.netty.handler.codec.haproxy.HAProxyMessageEncoder.