GHSA-cc37-9q2j-3hfv

Dashboard / Vulnerabilities / GHSA-cc37-9q2j-3hfv

GHSA-cc37-9q2j-3hfv

Summary: Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

Details: When decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released.

References: https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv, https://nvd.nist.gov/vuln/detail/CVE-2026-44893, https://github.com/netty/netty, https://github.com/netty/netty/releases/tag/netty-4.1.135.Final, https://github.com/netty/netty/releases/tag/netty-4.2.15.Final