Executive brief
Netty is a widely used networking framework that helps developers build high-performance servers and clients. A flaw in how it handles certain connection headers can cause the system to leak memory every time a specific type of request is received. Over time, this can exhaust the server's available memory, leading to performance degradation or a complete service outage.
Technical details
A memory leak exists in the HAProxy PROXY protocol v2 codec of Netty due to an unbalanced reference count during the parsing of nested TLV (Type-Length-Value) records. Specifically, when a client sends a valid header containing nested PP2_TYPE_SSL TLVs at a depth of two or greater, the underlying cumulation buffer (ByteBuf) remains pinned even after successful parsing and message release. This occurs on the successful parse path without triggering exceptions, meaning the decoder removes itself while the pooled memory remains unreleased. Attackers can exploit this remotely without authentication to cause memory exhaustion (DoS). The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.
Affected products
- Netty Project Netty < 4.1.135.Final, >= 4.2.0.Final, <= 4.2.14.Final
Timeline
- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-h2qv-fj59-j46j published
- 2026-06-12: disclosed: CVE-2026-48059 published to NVD