CVE-2026-48059: Netty HAProxy Protocol v2 Memory Leak Denial of Service

Technical summary

The vulnerability exists in Netty's HAProxy PROXY protocol v2 codec implementation. The parser correctly validates and processes syntactically valid headers containing nested PP2_TYPE_SSL TLVs (type-length-value records) at depth two or greater. However, the cumulation buffer—a pooled ByteBuf allocated from the channel's memory pool—is not released on the normal completion path. While the HAProxyMessage object itself is properly released by the application layer, the underlying native or heap memory buffer remains pinned in the pool. Each connection matching this pattern leaks its cumulation buffer, preventing garbage collection or buffer pool reuse. The vulnerability manifests as a silent resource leak during successful parsing, not as an exception or parsing failure.

Business impact

Organizations running Netty-based proxy or load-balancer services face gradual memory exhaustion when clients send crafted HAProxy PROXY protocol v2 headers. Unlike crash-inducing vulnerabilities, this leak is insidious: memory usage grows slowly and continuously, potentially remaining unnoticed until the server runs out of available memory and becomes unresponsive. Services handling untrusted or adversary-controlled client connections are most at risk. The impact includes service degradation, eventual forced restart cycles, and potential operational disruption during peak traffic periods.

Affected systems

Netty versions 4.1.0 through 4.1.134.Final and 4.2.0 through 4.2.14.Final are affected. Any application using Netty's HAProxy PROXY protocol v2 decoder is vulnerable if it processes client connections where a malicious or misconfigured client can send HAProxy headers with nested SSL metadata. This includes reverse proxies, load balancers, API gateways, and protocol servers built on Netty that enable HAProxy protocol support.

Exploitability

Exploitation is straightforward: an attacker needs only network access to the affected service and the ability to send a syntactically valid HAProxy PROXY protocol v2 header with nested PP2_TYPE_SSL records. No authentication, special privileges, or complex setup is required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects this ease of access. The vulnerability requires repeated connections to cause noticeable memory exhaustion, making it suitable for distributed or sustained attacks. No public exploit code or in-the-wild activity is currently tracked, but the low barrier to exploitation means weaponization would be trivial.

Remediation

Upgrade affected Netty installations immediately to version 4.1.135.Final or later for the 4.1.x line, or 4.2.15.Final or later for the 4.2.x line. These versions include the fix to properly release the cumulation buffer on successful HAProxy v2 header parsing. If immediate patching is not feasible, consider disabling HAProxy PROXY protocol v2 support in your application configuration, though this may require protocol negotiation changes with upstream proxies.

Patch guidance

Apply patches according to your Netty deployment model: for Maven users, update the netty-codec-http or netty-all dependency to 4.1.135.Final (or 4.2.15.Final if using the 4.2 series) and rebuild. For containerized deployments, rebuild images with the updated Netty library and restart services with new images. Verify the fix by checking that memory usage on the affected service no longer increases monotonically during normal HAProxy protocol v2 traffic. Regression testing should confirm that legitimate HAProxy PROXY protocol v2 connections continue to work correctly after the patch.

Detection guidance

Monitor Netty-based services for gradual, monotonic growth in heap or native memory usage without corresponding increases in active connections or request throughput. Heap dump analysis of affected services may reveal pinned ByteBuf objects from Netty's pooled allocator that have not been released. Network-level detection is less practical since valid HAProxy headers appear legitimate; focus on behavioral anomalies such as out-of-memory errors, garbage collection pauses, or service restarts correlated with client connections using HAProxy protocol v2. Application logs should be reviewed for warnings related to buffer pool exhaustion.

Why prioritize this

While this vulnerability is a denial-of-service rather than code execution or data breach, its silent nature and reliance on continued connection streams makes it operationally impactful. The CVSS score of 7.5 (HIGH) reflects the ease of exploitation and the availability impact. Organizations running Netty-based critical infrastructure (proxies, load balancers, APIs) should prioritize patching to prevent gradual resource exhaustion. The low complexity of exploitation and lack of authentication requirements elevate the priority for any service exposed to untrusted networks.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) assigns maximum points for network accessibility (AV:N), low attack complexity (AC:L), and no privilege or user interaction requirements (PR:N/UI:N). The impact is availability only (A:H, C:N, I:N), reflecting the denial-of-service nature. The score does not account for the potential for distributed, sustained attack or the silent, hard-to-detect nature of the leak; operationally, this vulnerability may warrant higher urgency in resource-constrained environments.

Frequently asked questions