CVE-2026-93564 describes a reference-count leak vulnerability in the HAProxy PROXY-v2 message decoder component of Netty. An attacker can send specially crafted PROXY-protocol v2 headers remotely without authentication, triggering the leak. This leads to memory exhaustion and causes a denial of service on the affected system. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability enables remote denial of service by exhausting memory resources through a reference-count leak in the PROXY-v2 message decoder. There is no impact on confidentiality or integrity reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor advisories for updates and apply patches once available.