GHSA-h2qv-fj59-j46j
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
Quick fix
GHSA-h2qv-fj59-j46j — io.netty:netty-codec-haproxy: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.2.15.Final</version> for io.netty:netty-codec-haproxyDetails
### Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned.
Are you affected?
Enter the version of the package you're using.
Affected packages
4.2.0.FinalFixed in: 4.2.15.Final# pom.xml: bump <version>4.2.15.Final</version> for io.netty:netty-codec-haproxy0Fixed in: 4.1.135.Final# pom.xml: bump <version>4.1.135.Final</version> for io.netty:netty-codec-haproxyReferences
- https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-48059[ADVISORY]
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48059.json[WEB]
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final[WEB]
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final[WEB]
- https://github.com/netty/netty[PACKAGE]
- https://bugzilla.redhat.com/show_bug.cgi?id=2488437[WEB]
- https://access.redhat.com/security/cve/CVE-2026-48059[WEB]
- https://access.redhat.com/errata/RHSA-2026:66488[WEB]
- https://access.redhat.com/errata/RHSA-2026:65126[WEB]
- https://access.redhat.com/errata/RHSA-2026:54435[WEB]
- https://access.redhat.com/errata/RHSA-2026:53806[WEB]
- https://access.redhat.com/errata/RHSA-2026:53646[WEB]
- https://access.redhat.com/errata/RHSA-2026:53645[WEB]
- https://access.redhat.com/errata/RHSA-2026:53644[WEB]
- https://access.redhat.com/errata/RHSA-2026:50085[WEB]
- https://access.redhat.com/errata/RHSA-2026:48151[WEB]
- https://access.redhat.com/errata/RHSA-2026:41951[WEB]
- https://access.redhat.com/errata/RHSA-2026:37390[WEB]
- https://access.redhat.com/errata/RHSA-2026:36820[WEB]
- https://access.redhat.com/errata/RHSA-2026:34608[WEB]
- https://access.redhat.com/errata/RHSA-2026:26586[WEB]
- https://access.redhat.com/errata/RHSA-2026:26018[WEB]
- https://access.redhat.com/errata/RHSA-2026:26017[WEB]