CVE-2026-48059
High · 7.5CVSS
7.5
EPSS
0.9%
Published
Jun 12, 2026
CISA due date
—
The record
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | netty | 0 | 4.1.135-1.1 |
Related vulnerabilities
- CVE-2026-50560 Netty is a network application framework for development of protocol servers and clients. Also affects netty
- CVE-2026-50020 Netty is a network application framework for development of protocol servers and clients. Also affects netty
- CVE-2026-50011 Netty is a network application framework for development of protocol servers and clients. Also affects netty
- CVE-2026-50010 Netty is a network application framework for development of protocol servers and clients. Also affects netty
- CVE-2026-48043 Netty is a network application framework for development of protocol servers and clients. Also affects netty
- CVE-2026-47691 Netty is a network application framework for development of protocol servers and clients. Also affects netty
- CVE-2026-48006 Netty is a network application framework for development of protocol servers and clients. Also affects netty
- CVE-2026-47244 Netty is a network application framework for development of protocol servers and clients. Also affects netty