CRLF Injection Affecting io.netty:netty-codec-haproxy package, versions [,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IONETTY-18233122
- published23 Jul 2026
- disclosed22 Jul 2026
- creditUnknown
Introduced: 22 Jul 2026
NewCVE-2026-59919 (opens in a new tab)How to fix?
Upgrade io.netty:netty-codec-haproxy to version 4.1.136.Final, 4.2.16.Final or higher.
Overview
Affected versions of this package are vulnerable to CRLF Injection via the encodeV1. An attacker can inject arbitrary CRLF sequences into AF_UNIX addresses by supplying specially crafted input, resulting in the creation of multiple PROXY protocol header lines. This can lead to client IP spoofing or manipulation of downstream server behavior by injecting unauthorized PROXY headers.
Note: This is only exploitable if user-controlled input is used as the AF_UNIX address in the construction of HAProxy V1 protocol headers and the encoded header is sent to a downstream server or load balancer.