GHSA-wh89-7897-x99h — Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Affected: Maven: io.netty:netty-codec-haproxy

# Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty

## 1. Vulnerability Summary

| Field | Value | |-------|-------| | **Product** | Netty | | **Version** | 4.2.12.Final (and all prior versions with codec-haproxy) | | **Component** | `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` | | **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences | | **Impact** | HAProxy PROXY Protocol Injection / Client IP Spoofing | | **CVSS 3.1 Score** | **7.5 (High)** | | **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` |

## 2. Affected Components

- `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` — `encodeV1()` method (lines 63-77): writes `sourceAddress` and `destinationAddress` directly to output without CRLF validation - `io.netty.handler.codec.haproxy.HAProxyMessage` — constructor `checkAddress()` validates IPv4/IPv6 format but **only checks length for AF_UNIX** (line 439)

## 3. Vulnerability Description

Netty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format **without validating for CRLF characters**. The V1 protocol uses CRLF (`\r\n`) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header.

### Root Cause — Encoder

```java // HAProxyMessageEncoder.java:63-77 private static void encodeV1(HAProxyMessage msg, ByteBuf out)…

Most recent entries from all

GHSA-wh89-7897-x99h — Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address