GHSA-h2qv-fj59-j46j
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
At a glance
- Published
- Updated
- CVE
- CVE-2026-48059
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Description
### Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned.
Affected packages
| Package | Versions |
|---|---|
| Maven · io.netty:netty-codec-haproxy | introduced 4.2.0.Final, fixed 4.2.15.Final |
| Maven · io.netty:netty-codec-haproxy | introduced 0, fixed 4.1.135.Final |
References
- https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-48059 ADVISORY
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48059.json WEB
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final WEB
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final WEB
- https://github.com/netty/netty PACKAGE
- https://bugzilla.redhat.com/show_bug.cgi?id=2488437 WEB
- https://access.redhat.com/security/cve/CVE-2026-48059 WEB
- https://access.redhat.com/errata/RHSA-2026:66488 WEB
- https://access.redhat.com/errata/RHSA-2026:65126 WEB
- https://access.redhat.com/errata/RHSA-2026:54435 WEB
- https://access.redhat.com/errata/RHSA-2026:53806 WEB
- https://access.redhat.com/errata/RHSA-2026:53646 WEB
- https://access.redhat.com/errata/RHSA-2026:53645 WEB
- https://access.redhat.com/errata/RHSA-2026:53644 WEB
- https://access.redhat.com/errata/RHSA-2026:50085 WEB
- https://access.redhat.com/errata/RHSA-2026:48151 WEB
- https://access.redhat.com/errata/RHSA-2026:41951 WEB
- https://access.redhat.com/errata/RHSA-2026:37390 WEB
- https://access.redhat.com/errata/RHSA-2026:36820 WEB
- https://access.redhat.com/errata/RHSA-2026:34608 WEB
- https://access.redhat.com/errata/RHSA-2026:26586 WEB
- https://access.redhat.com/errata/RHSA-2026:26018 WEB
- https://access.redhat.com/errata/RHSA-2026:26017 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |