Io.netty:netty codec haproxy: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion (CVE-2026-48059)
### Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned.
AI Analysis
Technical Summary
The Netty HAProxy PROXY protocol v2 codec improperly manages reference counts when parsing nested PP2_TYPE_SSL TLVs, resulting in a memory leak on every connection with such headers. Although the message is processed normally downstream and the decoder removes itself, the underlying pooled ByteBuf remains pinned, causing native or heap memory exhaustion. This vulnerability is tracked as CVE-2026-48059 and is rated with high severity. Red Hat's advisories indicate that the issue is fixed by upgrading Netty to version 4.1.135.Final in their build of Quarkus versions 3.27.4.SP1 and 3.33.2.SP1.
Potential Impact
Successful exploitation leads to memory exhaustion on the affected system due to a leak in the HAProxy PROXY protocol v2 codec when processing crafted nested PP2_TYPE_SSL TLVs. This can cause denial of service conditions by exhausting native or heap memory resources. The leak occurs silently without exceptions, making detection more difficult. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Red Hat has released official security updates for their build of Quarkus that include an upgrade to Netty 4.1.135.Final, which fixes this vulnerability. Users of Red Hat build of Quarkus should apply the updates 3.27.4.SP1 or 3.33.2.SP1 or later to remediate this issue. Before applying these updates, ensure all previously released errata relevant to your system are applied. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.
Io.netty:netty codec haproxy: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion (CVE-2026-48059)
Description
### Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Netty HAProxy PROXY protocol v2 codec improperly manages reference counts when parsing nested PP2_TYPE_SSL TLVs, resulting in a memory leak on every connection with such headers. Although the message is processed normally downstream and the decoder removes itself, the underlying pooled ByteBuf remains pinned, causing native or heap memory exhaustion. This vulnerability is tracked as CVE-2026-48059 and is rated with high severity. Red Hat's advisories indicate that the issue is fixed by upgrading Netty to version 4.1.135.Final in their build of Quarkus versions 3.27.4.SP1 and 3.33.2.SP1.
Potential Impact
Successful exploitation leads to memory exhaustion on the affected system due to a leak in the HAProxy PROXY protocol v2 codec when processing crafted nested PP2_TYPE_SSL TLVs. This can cause denial of service conditions by exhausting native or heap memory resources. The leak occurs silently without exceptions, making detection more difficult. There are no reports of active exploitation in the wild.
Mitigation Recommendations
Red Hat has released official security updates for their build of Quarkus that include an upgrade to Netty 4.1.135.Final, which fixes this vulnerability. Users of Red Hat build of Quarkus should apply the updates 3.27.4.SP1 or 3.33.2.SP1 or later to remediate this issue. Before applying these updates, ensure all previously released errata relevant to your system are applied. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h2qv-fj59-j46j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48059"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a50babc68715ace435869e4
Added to database: 07/10/2026, 09:26:20 UTC
Last enriched: 07/10/2026, 10:20:45 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.