Loading vulnerability…
Memory leak denial of service in Netty HAProxy SSL TLV decoding
CVE-2026-44893 is a resource-release vulnerability in Netty's netty-codec-haproxy module affecting versions before 4.1.135.Final in the 4.1.x line and before 4.2.15.Final in the 4.2.x line. While decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() retains a slice of the input buffer before reading the one-byte client field and four-byte verify field. A TLV length below five bytes triggers an IndexOutOfBoundsException. HAProxyMessageDecoder catches HAProxyProtocolException but not this exception, leaving the retained slice on the pooled cumulation buffer unreleased. Repeated malformed messages can exhaust memory and cause denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attacker-controlled malformed HAProxy messages can leak pooled buffer memory. Repeated exploitation can exhaust available memory, degrade service, and cause denial of service in applications using the vulnerable decoder. No confidentiality compromise, integrity compromise, or code execution is established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. As a compensating control pending upgrade, restrict access to listeners using the HAProxy decoder to trusted proxy infrastructure and prevent untrusted clients from supplying PROXY protocol headers directly.
Patch, then assume compromise.
Upgrade io.netty:netty-codec-haproxy to 4.1.135.Final or later in the 4.1.x release line, or 4.2.15.Final or later in the 4.2.x release line. For products bundling Netty, install the applicable vendor update containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.