CVE-2026-59919: 
Java Analyse et atténuation des vulnérabilités

CVE-2026-59919 is a CRLF injection vulnerability in Netty's HAProxyMessageEncoder that allows a local attacker who controls an AF_UNIX socket address to forge HAProxy PROXY header lines, spoofing client source and destination IP addresses to downstream servers or load balancers. It affects Netty versions prior to 4.1.136.Final (all 4.1.x releases) and versions 4.2.0.Final through 4.2.15.Final. The vulnerability was disclosed on July 22, 2026 via GitHub Advisory GHSA-wh89-7897-x99h, with NVD publication on July 29, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Netty 4.2.16 Release).

The root cause is improper neutralization of CRLF sequences (CWE-93) in HAProxyMessageEncoder when encoding AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol. The HAProxy V1 protocol uses \r\n as its line terminator; while IPv4/IPv6 address format validation implicitly rejects CRLF characters, AF_UNIX addresses are only validated for length (up to 108 bytes), leaving CRLF characters unchecked. An attacker who controls an AF_UNIX address can embed \r\n sequences to split the single PROXY header line into multiple lines, effectively injecting a forged second PROXY header that presents an arbitrary client source/destination IP to any downstream server or load balancer that trusts the PROXY protocol. A complete, runnable Java proof-of-concept (HAProxyUnixCRLFPoC.java) is publicly available in the Netty security advisory, demonstrating the bug by verifying that multiple PROXY lines are emitted (GitHub Advisory).

Successful exploitation allows a local attacker with privileges to control AF_UNIX socket addresses to spoof client source and destination IP addresses as seen by downstream servers or load balancers that consume HAProxy PROXY protocol headers. This primarily affects integrity — access controls, rate limiting, logging, and audit trails that rely on client IP identity can be bypassed or manipulated. There is no direct confidentiality or availability impact, but IP spoofing can enable privilege escalation in environments where downstream services grant elevated trust based on source IP, or facilitate log tampering to obscure attacker activity (GitHub Advisory).

A proof-of-concept exploit (Java source code with compilation and execution instructions) is publicly available in the Netty GitHub security advisory. The NVD SSVC assessment classifies exploitation status as "poc" and notes the attack is not automatable, requiring local access with low privileges. The EPSS score is approximately 0.109%, indicating a low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Precondition: Gain local access to a system running a vulnerable Netty version (< 4.1.136.Final or 4.2.0–4.2.15.Final) where the application uses HAProxyMessageEncoder with AF_UNIX socket addresses and forwards traffic to a downstream server that trusts HAProxy PROXY protocol headers.
2. Craft malicious AF_UNIX address: Construct an AF_UNIX socket address string containing an embedded CRLF sequence (e.g., /tmp/sock\r\nPROXY TCP4 1.2.3.4 5.6.7.8 1234 80\r\n), keeping the total length within 108 bytes to pass the only validation check.
3. Inject via HAProxyMessage: Create a HAProxyMessage object using the malicious AF_UNIX address as the source or destination address and pass it through an EmbeddedChannel (or live channel) configured with HAProxyMessageEncoder.INSTANCE.
4. Observe header splitting: The encoder writes the address verbatim into the V1 PROXY header line; the embedded \r\n terminates the first PROXY line and begins a second forged PROXY line with attacker-controlled IP addresses.
5. Downstream trust exploitation: The downstream server or load balancer parses the forged second PROXY header line and treats the attacker-specified IP as the legitimate client source, bypassing IP-based access controls, rate limits, or audit logging (GitHub Advisory).

• Network: Unexpected or malformed HAProxy PROXY protocol headers observed in traffic between Netty-based proxies and downstream servers; PROXY headers containing AF_UNIX-style paths followed by additional PROXY header lines.
• Logs: Application or proxy logs showing multiple PROXY header lines within a single connection; downstream server access logs recording unexpected or internal IP addresses as client sources that do not match known client ranges.
• Process/Application: Netty application handling AF_UNIX socket connections where the source or destination address contains non-printable characters or \r\n sequences; anomalous access control decisions on downstream services attributable to unexpected source IPs.

Upgrade Netty to version 4.1.136.Final (for 4.1.x users) or 4.2.16.Final (for 4.2.x users), which add CRLF validation to AF_UNIX address handling in HAProxyMessageEncoder (Netty 4.2.16 Release, Netty 4.1.136 Release). As a workaround prior to patching, validate AF_UNIX addresses for CRLF characters in application code before passing them to HAProxyMessageEncoder, and implement network segmentation to restrict which entities can control AF_UNIX socket addresses used by Netty HAProxy encoders. Downstream servers should also be configured to reject or sanitize malformed PROXY headers where possible.

SUSE issued a security update (SUSE-SU-2026:3482-1) addressing this vulnerability in their packages, and AusCERT published bulletin ESB-2026.9084 referencing the issue. Quarkus released version 3.33.3 incorporating the fix. Tenable added detection coverage via Nessus plugins (330753, 332130) and cloud security checks. No significant independent researcher commentary or broad social media discussion has been observed beyond standard CVE tracking and vendor patch notifications (SUSE Advisory, Quarkus Release).