DEBIAN-CVE-2026-59919
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \r\n sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
DEBIAN-CVE-2026-59919
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-59919
netty
Source reference: /affected/0/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/0/versions1:4.1.48-11Source reference:
/affected/0/versions1:4.1.48-12Source reference:
/affected/0/versions1:4.1.48-13Source reference:
/affected/0/versions1:4.1.48-14Source reference:
/affected/0/versions1:4.1.48-15Source reference:
/affected/0/versions1:4.1.48-16Source reference:
/affected/0/versions1:4.1.48-7Source reference:
/affected/0/versions1:4.1.48-7+deb12u1Source reference:
/affected/0/versions1:4.1.48-7+deb12u2Source reference:
/affected/0/versions1:4.1.48-8Source reference:
/affected/0/versions1:4.1.48-9Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
netty
Source reference: /affected/1/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/1/versions1:4.1.48-10+deb13u1Source reference:
/affected/1/versions1:4.1.48-11Source reference:
/affected/1/versions1:4.1.48-12Source reference:
/affected/1/versions1:4.1.48-13Source reference:
/affected/1/versions1:4.1.48-14Source reference:
/affected/1/versions1:4.1.48-15Source reference:
/affected/1/versions1:4.1.48-16Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
netty
Source reference: /affected/2/package/name
- Affected versions
- 1:4.1.48-10
Source reference:
/affected/2/versions1:4.1.48-11Source reference:
/affected/2/versions1:4.1.48-12Source reference:
/affected/2/versions1:4.1.48-13Source reference:
/affected/2/versions1:4.1.48-14Source reference:
/affected/2/versions1:4.1.48-15Source reference:
/affected/2/versions1:4.1.48-16Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16",
"1:4.1.48-7",
"1:4.1.48-7+deb12u1",
"1:4.1.48-7+deb12u2",
"1:4.1.48-8",
"1:4.1.48-9"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-59919.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-10+deb13u1",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-59919.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "netty",
"purl": "pkg:deb/debian/netty?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1:4.1.48-10",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-15",
"1:4.1.48-16"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-59919.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58058 · Revision 1
- Added to Heist Feed
- Publisher date