CVE-2026-48059
highpriority · track · 30EPSS 0.006 · 50 %ileDEEUFRRUUSEPSS · scored 2026-10-27
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (58)
Products and version ranges known to be affected.
- IBM App Connect Enterprise Professionalall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:professional
- Red Hat Enterprise Linux Data Grid 8all versionscert_bundDEcpe:/o:redhat:enterprise_linux:data_grid_8
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1814Netty: Mehrere SchwachstellenDeutsch2026-06-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.
- GHSA-h2qv-fj59-j46jNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion2026-06-11ghsa · osvUS
### Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (27)
External citations — patches, advisories, analysis.
- https://github.com/netty/netty/releasesPatchcnnvd
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Finalcnnvd
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Finalcnnvd
- https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46jcnnvd
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Finalenisa_euvd
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Finalenisa_euvd
- https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46jenisa_euvd
- https://access.redhat.com/errata/RHSA-2026:26017nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan