TI-2026-42727 Aliases CVE-2026-59919 GHSA-wh89-7897-x99h

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

MEDIUM 58CWE-93Published 2026-07-29 · Updated 2026-07-29

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 19 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \r\n sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00165 5th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial netty (netty): 4.1.136.Final, 4.2.16.Finalio.netty:netty-codec-haproxy (Maven): 4.2.16.Final, 4.1.136.FinalRed Hat: 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
netty	netty	before 4.1.136.Final; 4.2.0.Final to before 4.2.16.Final	4.1.136.Final, 4.2.16.Final	Patch available	CNA
—	io.netty:netty-codec-haproxy (Maven)	4.2.0.Final to before 4.2.16.Final	4.2.16.Final	Patch available	GHSA-wh89-7897-x99h
—	io.netty:netty-codec-haproxy (Maven)	before 4.1.136.Final	4.1.136.Final	Patch available	GHSA-wh89-7897-x99h

netty Vendornetty Affected before 4.1.136.Final; 4.2.0.Final to before 4.2.16.Final Fixed in 4.1.136.Final, 4.2.16.Final Patch available CNA
io.netty:netty-codec-haproxy (Maven) Vendor— Affected 4.2.0.Final to before 4.2.16.Final Fixed in 4.2.16.Final Patch available GHSA-wh89-7897-x99h
io.netty:netty-codec-haproxy (Maven) Vendor— Affected before 4.1.136.Final Fixed in 4.1.136.Final Patch available GHSA-wh89-7897-x99h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:netty:netty::::::::	before 4.1.136; 4.2.0 to before 4.2.16	Vulnerable	netty

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.136; 4.2.0 to before 4.2.16 Vulnerable ·netty

Remediation

Fix · CNA netty (netty) Fixed in 4.1.136.Final, 4.2.16.Final
Fix · GHSA-wh89-7897-x99h io.netty:netty-codec-haproxy (Maven) Fixed in 4.2.16.Final Advisory →
Fix · GHSA-wh89-7897-x99h io.netty:netty-codec-haproxy (Maven) Fixed in 4.1.136.Final Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Cryostat 4	Affected	No fix yet: Fix deferred
OpenShift Serverless	Affected	No fix yet: Fix deferred
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat Build of Keycloak	Affected	No fix yet: Fix deferred
Red Hat Data Grid 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7	Affected	No fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat Satellite 6	Affected	No fix yet: Fix deferred
Red Hat Single Sign-On 7	Affected	No fix planned: Out of support scope
Red Hat build of Apache Camel - HawtIO 4	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 3	Affected	No fix planned: Out of support scope
Red Hat build of Debezium 3	Affected	No fix yet: Fix deferred
Red Hat build of Quarkus	Affected	No fix planned: Out of support scope
streams for Apache Kafka 2	Affected	No fix planned: Out of support scope
streams for Apache Kafka 3	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-59919
2026-10-03 Alias added: GHSA-wh89-7897-x99h

References

Exploit 1

https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h

Other 3

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences