The vulnerability (CVE-2026-59919) exists in Netty's HAProxyMessageEncoder.encodeV1() method, which writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol without checking for CRLF characters. Since the V1 protocol uses CRLF as line terminators, injected CRLF characters in the AF_UNIX source or destination address split the PROXY header into multiple lines, effectively injecting a second PROXY protocol header. The AF_UNIX address validation only enforces a maximum length of 108 bytes and does not validate content for CRLF sequences, unlike IPv4/IPv6 addresses that are format-validated to exclude CRLF. This flaw enables an attacker controlling AF_UNIX addresses to inject additional PROXY headers, potentially causing downstream servers or load balancers to accept spoofed client IP addresses. Exploitation requires that the application uses Netty's HAProxyMessageEncoder with user-controlled AF_UNIX addresses in PROXY protocol headers. No official patch or fix is referenced in the provided data.

The vulnerability allows an attacker to perform client IP spoofing by injecting a second PROXY protocol header line via CRLF injection in AF_UNIX socket addresses. This can mislead downstream servers or load balancers into accepting false client IP information, potentially affecting access control, logging, or auditing mechanisms that rely on accurate client IP data. The impact is limited to scenarios where Netty's HAProxyMessageEncoder is used with AF_UNIX addresses containing attacker-controlled input and the encoded PROXY headers are sent to downstream components that parse the HAProxy V1 protocol.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using user-controlled input in AF_UNIX addresses when constructing HAProxy V1 protocol headers with Netty's HAProxyMessageEncoder. Validate or sanitize AF_UNIX addresses to exclude CRLF characters before encoding. Consider upgrading to a fixed version once released or applying custom input validation to prevent CRLF injection.