# CVE-2026-59919: Netty CRLF injection in HAProxyMessageEncoder AF_UNIX addresses

Source: https://junglewise.ai/threats/cve-2026-59919-netty-crlf-injection-in-haproxymessageencoder-af-unix-addresses  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-59919 · Severity: medium · CVSS 5.5 · Published 2026-07-29

Netty is a widely used networking framework that helps applications communicate over the internet. A security flaw in its HAProxy protocol component allows an attacker to manipulate connection headers by injecting special characters into socket addresses. This could allow an attacker to spoof their IP address, potentially bypassing security filters or gaining unauthorized access to downstream systems that rely on these headers for identity verification.

Technologies: [io.netty:netty-codec-haproxy (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-codec-haproxy), [Netty Project Codec HAProxy](https://junglewise.ai/threats/technologies/codec-haproxy). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-59919 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59919 being exploited in the wild.

**How severe is CVE-2026-59919?** Medium severity, with a CVSS score of 5.5, published 29 July 2026.

**Which products and versions are affected?** io.netty:netty-codec-haproxy (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final; Netty Project Codec HAProxy <= 4.2.15.Final, <= 4.1.135.Final.

**Is there a fix for CVE-2026-59919?** Yes. io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59919 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59919?** Check whether you run io.netty:netty-codec-haproxy (Maven) or Netty Project Codec HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.16.Final or later

  ```sh
  # set io.netty:netty-codec-haproxy to 4.2.16.Final in your pom.xml or build.gradle
  ```


## Technical details

A CRLF injection vulnerability exists in Netty's HAProxyMessageEncoder when processing AF_UNIX (UNIX_STREAM/UNIX_DGRAM) addresses in the HAProxy V1 protocol. While IPv4 and IPv6 addresses undergo strict format validation, AF_UNIX addresses are only checked for length (max 108 bytes). An attacker who can control the source or destination address string can inject '\r\n' sequences to terminate the current PROXY line and start a new, forged PROXY line. This second header can be used to spoof client IP addresses to downstream load balancers or servers. The issue is fixed in Netty versions 4.1.136.Final and 4.2.16.Final.

## Affected products

- Netty Project Netty < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final

## Identifiers

- CVE-2026-59919
- GHSA-wh89-7897-x99h

## Timeline

- 2026-07-20: advisory: GitHub Security Advisory published by maintainers
- 2026-07-29: disclosed: CVE published to NVD dataset
- 2026-07-29: patched: Fixes released in 4.1.136.Final and 4.2.16.Final

## References

- [https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h](https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h)

## Related threats

- [Netty uncontrolled resource consumption in HAProxyMessageDecoder](https://junglewise.ai/threats/cve-2026-55851-netty-uncontrolled-resource-consumption-in-haproxymessagedecoder)
- [Netty memory leak in HAProxy PROXY protocol v2 codec](https://junglewise.ai/threats/cve-2026-48059-netty-memory-leak-in-haproxy-proxy-protocol-v2-codec)
- [Netty memory leak in HAProxyMessageDecoder SSL TLV parsing](https://junglewise.ai/threats/cve-2026-44893-netty-memory-leak-in-haproxymessagedecoder-ssl-tlv-parsing)
- [HAProxyMessageDecoder Stack Exhaustion DoS](https://junglewise.ai/threats/cve-2022-41881-haproxymessagedecoder-stack-exhaustion-dos)