Executive brief
Netty is a widely used networking framework that helps applications communicate over the internet. A security flaw in its HAProxy protocol component allows an attacker to manipulate connection headers by injecting special characters into socket addresses. This could allow an attacker to spoof their IP address, potentially bypassing security filters or gaining unauthorized access to downstream systems that rely on these headers for identity verification.
Technical details
A CRLF injection vulnerability exists in Netty's HAProxyMessageEncoder when processing AF_UNIX (UNIX_STREAM/UNIX_DGRAM) addresses in the HAProxy V1 protocol. While IPv4 and IPv6 addresses undergo strict format validation, AF_UNIX addresses are only checked for length (max 108 bytes). An attacker who can control the source or destination address string can inject '\r\n' sequences to terminate the current PROXY line and start a new, forged PROXY line. This second header can be used to spoof client IP addresses to downstream load balancers or servers. The issue is fixed in Netty versions 4.1.136.Final and 4.2.16.Final.
Affected products
- Netty Project Netty < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final
Timeline
- 2026-07-20: advisory: GitHub Security Advisory published by maintainers
- 2026-07-29: disclosed: CVE published to NVD dataset
- 2026-07-29: patched: Fixes released in 4.1.136.Final and 4.2.16.Final