CVE-2026-44893 Details
Description
Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
A memory leak vulnerability has been identified in the Netty codec for HAProxy, specifically in versions prior to 4.1.135.Final and 4.2.15.Final. The issue arises when decoding a PP2_TYPE_SSL TLV. The method HAProxyMessage.readNextTLV() first retains a slice of the header based on the TLV length, and then reads a 1-byte client field and a 4-byte verify field. If an attacker sets the TLV length to less than 5, the readByte and readInt operations will throw an IndexOutOfBoundsException. This exception is not properly handled, allowing it to propagate and causing the retained slice on the pooled cumulation buffer to be unreleased, leading to a memory leak.
Users can upgrade to Netty versions 4.1.135.Final or 4.2.15.Final to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-703 | Improper Check or Handling of Exceptional Conditions | [email protected] |
| CWE-805 | Buffer Access with Incorrect Length Value | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| netty netty | < 4.1.135 >= 4.2.0, < 4.2.15 |
CPE
Remediation
| |
Change History
19 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | redhat-SADP |
| Sep 11, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 3, 2026 | CVE Modified | redhat-SADP |
| Sep 3, 2026 | CVE Modified | [email protected] |
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Aug 5, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 9, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | New CVE Received | [email protected] |