In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls… (CVE-2026-44893)

Netty is a network application framework used for protocol servers and clients. In netty-codec-haproxy versions prior to 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, the method HAProxyMessage.readNextTLV() calls retainedSlice() on the header buffer before reading the 1-byte client field and 4-byte verify field. If the TLV length is set below 5 by an attacker, subsequent readByte/readInt calls throw an IndexOutOfBoundsException (IOOBE). Because HAProxyMessageDecoder only catches HAProxyProtocolException, the IOOBE propagates, preventing the release of the retained slice on the pooled cumulation buffer, potentially leading to resource exhaustion. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.

The vulnerability can lead to a denial-of-service condition due to resource exhaustion caused by unreleased buffer slices when an attacker sends malformed PP2_TYPE_SSL TLVs with insufficient length. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been identified.

Upgrade netty-codec-haproxy to version 4.1.135.Final or later, or 4.2.15.Final or later, where this issue is patched. No other mitigation is indicated by the vendor advisory.