Loading story…
Netty disclosed and fixed CVE-2026-48059, a memory leak in its HAProxy PROXY protocol v2 codec that can let remote clients exhaust server memory by sending syntactically valid headers with nested PP2_TYPE_SSL TLVs at depth two or greater. The flaw leaves the underlying pooled ByteBuf cumulation buffer permanently pinned even though parsing completes successfully and no exception is raised, creating an availability risk rather than a confidentiality or integrity impact.
The issue affects Netty releases before 4.1.135.Final and 4.2.15.Final, and the project published fixes in those versions alongside a GitHub security advisory. Separately, Netty also merged a non-security correction for memoryAddress() handling in wrapped direct ByteBuffer paths when Unsafe is disabled, shipping that consistency fix in 4.2.14.Final and auto-porting it to Netty 5.0, but the HAProxy memory-exhaustion bug is addressed in the later 4.2.15.Final release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE reference says GitHub published the security advisory associated with CVE-2026-48059. The advisory concerns a Netty HAProxy codec memory leak affecting versions before 4.1.135.Final and 4.2.15.Final.
Netty fixed CVE-2026-48059, a memory leak in HAProxy PROXY protocol v2 nested PP2_TYPE_SSL TLV parsing that can pin pooled ByteBuf buffers and cause memory exhaustion. The fix is available in versions 4.1.135.Final and 4.2.15.Final, but the source does not explicitly anchor the release date.
Netty merged a fix for inconsistent exposure of direct ByteBuffer memory addresses when Unsafe is disabled but platform address access is still available. The synopsis states this pull request was merged into the Netty 4.2 branch on 2026-05-18.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceredirect.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Netty published a broad set of security advisories covering **22 vulnerabilities** across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including **HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling**. Reported consequences include uncontrolled memory allocation, `ByteBuf` and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse. One of the most serious flaws, **`CVE-2026-45416`**, allows a remote attacker to send as little as **nine bytes** in a crafted TLS `ClientHello` and trigger roughly **16 MiB** of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects **Netty 4.1.x before `4.1.135.Final`** and **4.2.0.Final through `4.2.14.Final`**, and was fixed in **`4.1.135.Final`** and **`4.2.15.Final`**; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Jul 10, 2026
Netty released **4.1.135.Final** and **4.2.15.Final** to patch a large batch of security vulnerabilities across core networking components, with fixes spanning `netty-resolver-dns`, `netty-codec-http2`, `netty-handler`, `netty-codec-redis`, `netty-codec-haproxy`, native transports, and SCTP support. The DNS resolver fixes address multiple cache-poisoning paths, including predictable transaction IDs combined with a static UDP source port, missing bailiwick checks for **CNAME** records, and insufficient validation of **NS** records; one of those issues was later tracked as **CVE-2026-45674**. Netty also fixed a TLS flaw in which wrapping a plain `X509TrustManager` could silently disable hostname verification for clients, and an IPv6 access-control bypass in `IpSubnetFilterRule`, later assigned **CVE-2026-44249**.
Jun 29, 2026
Netty merged fixes to limit memory allocation in its Brotli and Zstandard HTTP decompression paths after identifying denial-of-service risks from attacker-controlled compressed input. One change passes `HttpContentDecompressor`'s `maxAllocation` setting to `BrotliDecoder` and `ZstdDecoder`, bringing them in line with gzip and zlib handling and reducing exposure to zip-bomb-style memory exhaustion in constrained environments. A second change adds a `maxWindowLog` parameter to `ZstdDecoder` so oversized Zstandard frames can be rejected before large native-memory allocations occur. The Zstandard issue stemmed from `libzstd` allocating memory based on a frame's declared window size before decoding, allowing a small malicious frame to force large per-stream allocations and potentially crash servers. Netty set `DEFAULT_MAX_WINDOW_LOG = 27`, validated configurable values in the range `10` to `31`, merged the changes into the 4.2 branch, and ported them to 4.1 and 5.0. The protections shipped in **Netty 4.2.15.Final**, alongside other security fixes, and downstream projects including **Apache Spark** and **ArcadeDB** moved to upgrade to consume the release.
Jun 29, 2026