CVE-2026-93564: Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)
HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven:io.netty:netty-codec-haproxyto a version that resolves this vulnerability.Fixed in 4.1.137.Final - Upgrade
Upgrade
maven:io.netty:netty-codec-haproxyto a version that resolves this vulnerability.Fixed in 4.2.17.Final - Configuration
On the exception path in HAProxyMessage.readNextTLV inner catch (referenced at HAProxyMessage.java:340), replace the flatten-unaware call releaseTlvs(encapsulatedTlvs) with the recursive releaseDeep(encapsulatedTlvs) so the grandchild ByteBuf tree is fully released.
io.netty.handler.codec.haproxy.HAProxyMessage.readNextTLV (HAProxyMessage.java:340) inner catch releases of nested SSL TLV tree = releaseDeep(encapsulatedTlvs) instead of releaseTlvs(encapsulatedTlvs) - Compensating control
Ensure the PROXY-protocol v2 decoder (HAProxyMessageDecoder, a ByteToMessageDecoder) is only exposed at the pipeline edge and is protected against sustained malformed header flooding to mitigate memory-exhaustion from the attacker-triggered exception path.
Event History
Frequently Asked Questions
What traffic is required to trigger the leak?
An attacker needs to send a HAProxy PROXY-v2 message containing nested TLVs in which an SSL TLV child has grandchildren, followed by a malformed sibling TLV that causes the inner error-handling path in readNextTLV to execute. The malformed sibling causes cleanup to miss the nested grandchildren.
Who is exposed to this issue?
Deployments using Netty's netty-codec-haproxy component to parse HAProxy PROXY-v2 messages are exposed when they process the affected nested-TLV structure. The supplied severity vector indicates the issue is reachable over the network with low attack complexity and does not require privileges or user interaction.