GHSA-h2qv-fj59-j46j

    Dashboard / Vulnerabilities / GHSA-h2qv-fj59-j46j

    GHSA-h2qv-fj59-j46j

    Published: 11 Jun 2026Last Modified: 18 Sept 2026

    Summary: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

    Details: ### Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned.

    References: https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j, https://nvd.nist.gov/vuln/detail/CVE-2026-48059, https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48059.json, https://github.com/netty/netty/releases/tag/netty-4.2.15.Final, https://github.com/netty/netty/releases/tag/netty-4.1.135.Final, https://github.com/netty/netty, https://bugzilla.redhat.com/show_bug.cgi?id=2488437, https://access.redhat.com/security/cve/CVE-2026-48059, https://access.redhat.com/errata/RHSA-2026:66488, https://access.redhat.com/errata/RHSA-2026:65126, https://access.redhat.com/errata/RHSA-2026:54435, https://access.redhat.com/errata/RHSA-2026:53806, https://access.redhat.com/errata/RHSA-2026:53646, https://access.redhat.com/errata/RHSA-2026:53645, https://access.redhat.com/errata/RHSA-2026:53644, https://access.redhat.com/errata/RHSA-2026:50085, https://access.redhat.com/errata/RHSA-2026:48151, https://access.redhat.com/errata/RHSA-2026:41951, https://access.redhat.com/errata/RHSA-2026:37390, https://access.redhat.com/errata/RHSA-2026:36820, https://access.redhat.com/errata/RHSA-2026:34608, https://access.redhat.com/errata/RHSA-2026:26586, https://access.redhat.com/errata/RHSA-2026:26018, https://access.redhat.com/errata/RHSA-2026:26017

    Affected packages

    Package

    Name: io.netty:netty-codec-haproxy

    Purl: pkg:maven/io.netty/netty-codec-haproxy

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 4.2.0.Final
    Fixed -4.2.15.Final

    Affected versions

    4.2.0.Final
    4.2.1.Final
    4.2.10.Final
    4.2.11.Final
    4.2.12.Final
    4.2.13.Final
    4.2.14.Final
    4.2.2.Final
    4.2.3.Final
    4.2.4.Final
    4.2.5.Final
    4.2.6.Final
    4.2.7.Final
    4.2.8.Final
    4.2.9.Final

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-h2qv-fj59-j46j | CVE-DB