Is CVE-2026-48059 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48059 being exploited in the wild.

How severe is CVE-2026-48059?

High severity, with a CVSS score of 3.1, published 12 June 2026.

Which products and versions are affected?

io.netty:netty-codec-haproxy (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final.

Is there a fix for CVE-2026-48059?

Yes. io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48059 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48059?

Check whether you run io.netty:netty-codec-haproxy (Maven) or Netty Project Codec HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48059: Netty memory leak in HAProxy PROXY protocol v2 codec

CVE-2026-48059 · Severity: high · CVSS 3.1 · Published 2026-06-12

Netty is a widely used networking framework that helps developers build high-performance servers and clients. A flaw in how it handles certain connection headers can cause the system to leak memory every time a specific type of request is received. Over time, this can exhaust the server's available memory, leading to performance degradation or a complete service outage.

Technologies: io.netty:netty-codec-haproxy (Maven), Netty Project Codec HAProxy. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-48059 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48059 being exploited in the wild.
How severe is CVE-2026-48059?: High severity, with a CVSS score of 3.1, published 12 June 2026.
Which products and versions are affected?: io.netty:netty-codec-haproxy (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final.
Is there a fix for CVE-2026-48059?: Yes. io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48059 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48059?: Check whether you run io.netty:netty-codec-haproxy (Maven) or Netty Project Codec HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.netty:netty-codec-haproxy (Maven): upgrade to 4.2.15.Final or later

# set io.netty:netty-codec-haproxy to 4.2.15.Final in your pom.xml or build.gradle

Technical details

A memory leak exists in the HAProxy PROXY protocol v2 codec of Netty due to an unbalanced reference count during the parsing of nested TLV (Type-Length-Value) records. Specifically, when a client sends a valid header containing nested PP2_TYPE_SSL TLVs at a depth of two or greater, the underlying cumulation buffer (ByteBuf) remains pinned even after successful parsing and message release. This occurs on the successful parse path without triggering exceptions, meaning the decoder removes itself while the pooled memory remains unreleased. Attackers can exploit this remotely without authentication to cause memory exhaustion (DoS). The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.

Affected products

Netty Project Netty < 4.1.135.Final, >= 4.2.0.Final, <= 4.2.14.Final

Identifiers

CVE-2026-48059
GHSA-h2qv-fj59-j46j

Timeline

2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
2026-06-05: advisory: GitHub Security Advisory GHSA-h2qv-fj59-j46j published
2026-06-12: disclosed: CVE-2026-48059 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.