Loading vulnerability…
Denial of Service via Memory Leak in Netty HAProxy PROXY Protocol v2 Codec
CVE-2026-48059 is a memory-leak vulnerability in Netty's HAProxy PROXY protocol v2 codec affecting releases before 4.1.135.Final in the 4.1 line and 4.2.15.Final in the 4.2 line. Parsing a syntactically valid header containing PP2_TYPE_SSL type-length-value records nested at depth two or greater causes unbalanced reference counting that permanently pins the channel's underlying cumulation buffer, a pooled and potentially direct ByteBuf. The leak occurs during successful parsing: no exception is thrown, the message is passed downstream, the decoder removes itself, and normal release of the HAProxyMessage does not free the pinned buffer. Repeated triggering connections can exhaust native or heap memory and cause denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Each triggering connection permanently retains native or heap memory. Repeated connections can exhaust the application's available memory, degrading or interrupting service. Normal message release does not prevent the leak, and successful parsing produces no exception to signal the condition. The vulnerability affects availability; no confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
Until patched, restrict PROXY protocol v2 listeners to trusted proxies and prevent untrusted clients from reaching them directly. Filter or reject headers containing nested PP2_TYPE_SSL TLVs before they reach the vulnerable decoder. Connection-rate limits and memory monitoring can reduce denial-of-service risk but do not correct the leak.
Patch, then assume compromise.
Upgrade io.netty:netty-codec-haproxy to 4.1.135.Final or later within the 4.1 release line, or 4.2.15.Final or later within the 4.2 release line. For products bundling Netty, apply the vendor's security update containing the patched dependency.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.