CVE-2026-44893: Netty HAProxy Codec Memory Leak Denial of Service

Technical summary

CVE-2026-44893 exists in netty-codec-haproxy's HAProxyMessage.readNextTLV() method. The vulnerability arises from a logic flaw in PP2_TYPE_SSL TLV decoding: a retained slice is created based on attacker-controlled length metadata before validation occurs. The code then attempts to read a 1-byte client field and 4-byte verify field. If length is set below 5 bytes, readByte() or readInt() throws IndexOutOfBoundsException. HAProxyMessageDecoder's exception handler only catches HAProxyProtocolException, allowing IOOBE to propagate uncaught. The retained slice reference is never released, causing the pooled cumulation buffer memory to leak. Repeated exploitation leads to memory exhaustion and denial of service.

Business impact

Availability risk to any service exposing HAProxy protocol endpoints. Applications using netty-codec-haproxy to decode upstream load-balancer or proxy traffic become vulnerable to memory exhaustion attacks. An unauthenticated remote attacker can send low-cost, malformed protocol frames to gradually consume heap memory until the JVM crashes or triggers garbage collection storms that degrade performance. For containerized deployments, this may trigger repeated pod restarts, cascading operational impact across microservices architectures.

Affected systems

Netty versions prior to 4.1.135.Final and 4.2.15.Final are affected. Any application embedding netty-codec-haproxy and accepting HAProxy protocol traffic requires patching. This includes reverse proxies, API gateways, and application servers that sit behind HAProxy or compatible load balancers and parse the protocol on the inbound side.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and no special network conditions—any network-accessible HAProxy protocol listener is at risk. The attack is trivial to execute: send a PP2_TYPE_SSL TLV frame with length < 5. No special tools, exploit frameworks, or zero-day knowledge needed. CVSS 7.5 (HIGH) reflects network-reachable, unauthenticated denial of service with no confidentiality or integrity impact.

Remediation

Upgrade netty-codec-haproxy to version 4.1.135.Final or later (for 4.1.x series) or 4.2.15.Final or later (for 4.2.x series). The patch adds validation to ensure the TLV length is sufficient before attempting field reads, and ensures the retained slice is released even if an exception occurs. Verify compatibility with your application's Netty dependency footprint before deploying.

Patch guidance

1. Identify all applications and services using netty-codec-haproxy in your inventory. 2. Review your Netty bill-of-materials (BOM) or dependency tree for the current version. 3. Plan upgrades to 4.1.135.Final or 4.2.15.Final, depending on your 4.x branch. 4. Test patched builds in a staging environment that includes HAProxy protocol traffic replay or simulation. 5. Deploy during a maintenance window and monitor JVM memory metrics and garbage collection logs for the first 24–48 hours post-deployment to confirm memory leak resolution. 6. If you are not directly managing Netty versions (e.g., Spring Boot, Vert.x, or other frameworks bundle it), verify the parent framework has released a compatible version.

Detection guidance

Monitor applications for: (1) Repeated IndexOutOfBoundsException in HAProxyMessage or HAProxyMessageDecoder logs, especially if unhandled; (2) Steady heap memory growth without corresponding increase in legitimate request volume; (3) Increased garbage collection pauses or full GC frequency; (4) Network packets to HAProxy protocol ports (default 8020/TCP) with suspiciously short PP2_TYPE_SSL TLV payloads (< 5 bytes). Alerting on IOOBE exceptions from Netty codec classes can provide early warning before memory exhaustion manifests. Memory profilers or heap dumps may reveal large numbers of retained ByteBuf references from the pooled allocator.

Why prioritize this

HIGH priority for any public-facing or internal-network-facing service accepting HAProxy protocol input. The attack is trivial, unauthenticated, and leads to application unavailability. Prioritize services in load-balancer frontends, API gateway tiers, and microservices ingress controllers. Organizations with SLAs or uptime commitments should treat this as critical infrastructure and patch within 1–2 weeks.

Risk score, explained

CVSS 7.5 reflects: (1) Network vector—any remote attacker with network access can trigger the flaw; (2) Low attack complexity—no special conditions; (3) No privilege or user interaction required; (4) High availability impact via memory leak and crash; (5) No confidentiality or integrity compromise. The score appropriately captures denial-of-service severity in a protocol decoder serving as a trust boundary to upstream infrastructure.

Frequently asked questions