Netty fixes HAProxy TLV parsing memory leak that can exhaust server memory
Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Jun 12, 2026
Netty disclosed and fixed CVE-2026-48059, a memory leak in its HAProxy PROXY protocol v2 codec that can let remote clients exhaust server memory by sending syntactically valid headers with nested PP2_TYPE_SSL TLVs at depth two or greater. The flaw leaves the underlying pooled ByteBuf cumulation buffer permanently pinned even though parsing completes successfully and no exception is raised, creating an availability risk rather than a confidentiality or integrity impact.
The issue affects Netty releases before 4.1.135.Final and 4.2.15.Final, and the project published fixes in those versions alongside a GitHub security advisory. Separately, Netty also merged a non-security correction for memoryAddress() handling in wrapped direct ByteBuffer paths when Unsafe is disabled, shipping that consistency fix in 4.2.14.Final and auto-porting it to Netty 5.0, but the HAProxy memory-exhaustion bug is addressed in the later 4.2.15.Final release.
