CVE-2026-59919: Netty CRLF injection in HAProxyMessageEncoder AF_UNIX addresses

CVE-2026-59919 · Severity: medium · CVSS 5.5 · Published 2026-07-29

Netty is a widely used networking framework that helps applications communicate over the internet. A security flaw in its HAProxy protocol component allows an attacker to manipulate connection headers by injecting special characters into socket addresses. This could allow an attacker to spoof their IP address, potentially bypassing security filters or gaining unauthorized access to downstream systems that rely on these headers for identity verification.

Technologies: io.netty:netty-codec-haproxy (Maven), Netty Project Codec HAProxy. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-59919 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59919 being exploited in the wild.
How severe is CVE-2026-59919?
Medium severity, with a CVSS score of 5.5, published 29 July 2026.
Which products and versions are affected?
io.netty:netty-codec-haproxy (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final; Netty Project Codec HAProxy <= 4.2.15.Final, <= 4.1.135.Final.
Is there a fix for CVE-2026-59919?
Yes. io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59919 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59919?
Check whether you run io.netty:netty-codec-haproxy (Maven) or Netty Project Codec HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.16.Final or later
    # set io.netty:netty-codec-haproxy to 4.2.16.Final in your pom.xml or build.gradle

Technical details

A CRLF injection vulnerability exists in Netty's HAProxyMessageEncoder when processing AF_UNIX (UNIX_STREAM/UNIX_DGRAM) addresses in the HAProxy V1 protocol. While IPv4 and IPv6 addresses undergo strict format validation, AF_UNIX addresses are only checked for length (max 108 bytes). An attacker who can control the source or destination address string can inject '\r\n' sequences to terminate the current PROXY line and start a new, forged PROXY line. This second header can be used to spoof client IP addresses to downstream load balancers or servers. The issue is fixed in Netty versions 4.1.136.Final and 4.2.16.Final.

Affected products

  • Netty Project Netty < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final

Identifiers

  • CVE-2026-59919
  • GHSA-wh89-7897-x99h

Timeline

  • 2026-07-20: advisory: GitHub Security Advisory published by maintainers
  • 2026-07-29: disclosed: CVE published to NVD dataset
  • 2026-07-29: patched: Fixes released in 4.1.136.Final and 4.2.16.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.