# CVE-2026-44893: Netty memory leak in HAProxyMessageDecoder SSL TLV parsing

Source: https://junglewise.ai/threats/cve-2026-44893-netty-memory-leak-in-haproxymessagedecoder-ssl-tlv-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-44893 · Severity: high · CVSS 7.5 · Published 2026-06-12

Netty is a widely used networking framework that helps developers build high-performance servers and clients. A vulnerability in its HAProxy protocol support allows a remote attacker to trigger memory leaks by sending specially crafted network packets. Over time, these leaks can exhaust the server's available memory, leading to performance degradation or a complete service outage.

Technologies: [io.netty:netty-codec-haproxy (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-codec-haproxy), [Netty Project Codec HAProxy](https://junglewise.ai/threats/technologies/codec-haproxy). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-44893 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44893 being exploited in the wild.

**How severe is CVE-2026-44893?** High severity, with a CVSS score of 7.5, published 12 June 2026.

**Which products and versions are affected?** io.netty:netty-codec-haproxy (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final.

**Is there a fix for CVE-2026-44893?** Yes. io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44893 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44893?** Check whether you run io.netty:netty-codec-haproxy (Maven) or Netty Project Codec HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.15.Final or later

  ```sh
  # set io.netty:netty-codec-haproxy to 4.2.15.Final in your pom.xml or build.gradle
  ```


## Technical details

A memory leak exists in the netty-codec-haproxy module during the parsing of PP2_TYPE_SSL TLV fields. In HAProxyMessage.readNextTLV(), the code creates a retained slice of the pooled cumulation buffer before validating that enough data exists for the subsequent 1-byte client and 4-byte verify fields. If an attacker provides a TLV length less than 5, an IndexOutOfBoundsException (IOOBE) is thrown. Because HAProxyMessageDecoder only catches HAProxyProtocolException, the IOOBE propagates, preventing the release of the retained slice. This results in a cumulative memory leak that can be triggered remotely without authentication, eventually leading to an OutOfMemoryError. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.

## Affected products

- Netty Project Netty < 4.1.135.Final, 4.2.0.Final - 4.2.14.Final

## Identifiers

- CVE-2026-44893
- GHSA-cc37-9q2j-3hfv

## Timeline

- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released.
- 2026-06-05: advisory: GitHub Security Advisory GHSA-cc37-9q2j-3hfv published.
- 2026-06-12: disclosed: CVE-2026-44893 published to NVD.

## References

- [https://github.com/netty/netty/releases/tag/netty-4.1.135.Final](https://github.com/netty/netty/releases/tag/netty-4.1.135.Final)
- [https://github.com/netty/netty/releases/tag/netty-4.2.15.Final](https://github.com/netty/netty/releases/tag/netty-4.2.15.Final)
- [https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv](https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv)

## Related threats

- [Netty CRLF injection in HAProxyMessageEncoder AF_UNIX addresses](https://junglewise.ai/threats/cve-2026-59919-netty-crlf-injection-in-haproxymessageencoder-af-unix-addresses)
- [Netty uncontrolled resource consumption in HAProxyMessageDecoder](https://junglewise.ai/threats/cve-2026-55851-netty-uncontrolled-resource-consumption-in-haproxymessagedecoder)
- [Netty memory leak in HAProxy PROXY protocol v2 codec](https://junglewise.ai/threats/cve-2026-48059-netty-memory-leak-in-haproxy-proxy-protocol-v2-codec)
- [HAProxyMessageDecoder Stack Exhaustion DoS](https://junglewise.ai/threats/cve-2022-41881-haproxymessagedecoder-stack-exhaustion-dos)