CVE-2026-59919

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

CVE-2026-59919: Improper Neutralization of CRLF Sequences

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

Netty HAProxyMessage Encoder

The vulnerability of the HAProxyMessage and HAProxyMessageEncoder classes in the Netty framework for developing network applications, servers, and clients is related to the failure to handle CRLF sequences properly. Exploiting this vulnerability can allow an attacker to replace legitimate data wi...