CVE-2026-48059

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested PP2_TYPE_SSL TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the HAProxyMessage normally. Yet the underlying cumulation buffer (a pooled, potentially direct ByteBuf allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Impact

The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested PP2_TYPE_SSL TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the HAProxyMessage normally. Yet the underlying cumulation buffer (a pooled, potentially direct ByteBuf allocated by the channel) remains permanently pinned.

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-haproxy 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-44893, CVE-2026-48059, CVE-2026-55851, and CVE-2026-59919.

CVE-2026-44893: Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

CVE-2026-48059: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

CVE-2026-55851: Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

CVE-2026-59919: Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

This patched artifact is a drop-in replacement for io.netty:netty-codec-haproxy 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested PP2_TYPE_SSL TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the HAProxyMessage normally. Yet the underlying cumulation buffer (a pooled, potentially direct ByteBuf allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

TuxCare rebuilt 7 io.netty packages to address 11 CVEs. Fixed in 4.1.130.Final-tuxcare.1.

TuxCare rebuilt 5 io.netty packages to address 8 CVEs. Fixed in 4.1.117.Final-tuxcare.2.

TuxCare rebuilt 8 io.netty packages to address 13 CVEs. Fixed in 4.1.115.Final-tuxcare.7.

TuxCare rebuilt 9 io.netty packages to address 14 CVEs. Fixed in 4.1.112.Final-tuxcare.5.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 5 io.netty packages to address 6 CVEs. Fixed in 4.1.93.Final-tuxcare.3.

TuxCare rebuilt 12 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2.

TuxCare rebuilt 43 io.netty packages to address 7 CVEs. Fixed in 4.1.63.Final-tuxcare.8.

TuxCare rebuilt 11 io.netty packages to address 20 CVEs. Fixed in 4.1.73.Final-tuxcare.5.

TuxCare rebuilt 5 io.netty packages to address 9 CVEs. Fixed in 4.1.48.Final-tuxcare.4.

TuxCare rebuilt 6 io.netty packages to address 13 CVEs. Fixed in 4.1.42.Final-tuxcare.1.

TuxCare rebuilt 15 io.netty packages to address 27 CVEs. Fixed in 4.1.72.Final-tuxcare.1.

TuxCare rebuilt 43 io.netty packages to address 25 CVEs. Fixed in 4.1.68.Final-tuxcare.1.

TuxCare rebuilt 40 io.netty packages to address 26 CVEs. Fixed in 4.1.53.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 11 CVEs. Fixed in 4.1.39.Final-tuxcare.1.

TuxCare rebuilt 11 io.netty packages to address 21 CVEs. Fixed in 4.1.51.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 8 CVEs. Fixed in 4.1.52.Final-tuxcare.4.

TuxCare rebuilt 8 io.netty packages to address 11 CVEs. Fixed in 4.1.43.Final-tuxcare.3.

TuxCare rebuilt 7 io.netty packages to address 9 CVEs. Fixed in 4.1.59.Final-tuxcare.1.

TuxCare rebuilt 10 io.netty packages to address 17 CVEs. Fixed in 4.1.49.Final-tuxcare.6.

TuxCare rebuilt 43 io.netty packages to address 22 CVEs. Fixed in 4.1.60.Final-tuxcare.3.

TuxCare rebuilt 14 io.netty packages to address 32 CVEs. Fixed in 4.1.64.Final-tuxcare.1.

TuxCare rebuilt 8 io.netty packages to address 10 CVEs. Fixed in 4.1.74.Final-tuxcare.2.

These are all security issues fixed in the netty-4.1.135-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issue

This update for netty, netty-tcnative fixes the following issues

Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:

• CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).
• CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).
• CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).
• CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).
• CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).
• CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).
• CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).
• CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).
• CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (bsc#1268250).
• CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).
• CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).
• CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (bsc#1268255).
• CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).
• CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers (bsc#1268258).
• CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).
• CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).
• CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (bsc#1268261).
• CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (bsc#1268262).

Changes:

• MQTT: Allow MQTT 5 CONNECT with password only
• ChannelInitializer: correct misleading comment on exceptionCaught route
• HTTP/2: Parse request-target path like Vert.x (4.1 backport)
• HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
• IpSubnetFilter: Correctly handle ipv6
• Configurable bound on RedisArrayAggregator
• Redis: Limit decoded length
• DNS: Ensure query id is not predictible
• Wrapping plain trust manager silently disables hostname verification
• MQTT: Reject malformed no-payload packets with non-zero Remaining Length
• HAProxy: Reject HAProxyMessages with malformated TLV and not leak memory
• SSL: Use sane defaults as limits for the client hello length and timeout
• DNS: Only cache CNAME if part of the queried domain
• HTTP/2: Enforce max concurrent streams for misbehaving clients
• Dns: Insufficient Bailiwick Validation for NS Records
• HTTP2: DelegatingDecompressorFrameListener must release memory in all cases
• Pass maxAllocation to Brotli and Zstd decoders
• HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory
• Add maxWindowLog parameter to ZstdDecoder to bound memory allocation
• HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs
• Epoll / Kqueue: Correctly handle receive of FD
• SCTP: Limit the number of inflight incomplete SCTP messages and the number of fragments
• Redis: Correctly release incomplete message on removal when using RedisArrayAggregator
• Redis: Limit the maximum number of nested arrays
• HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake
• Marshalling: Explicit document security requirements
• Pin HTTP/RTSP version + method normalization to Locale.US
• Adaptive: Fix concurrency issue in adaptive allocator
• Pin multipart Content-Type / Content-Transfer-Encoding case…