PT-2026-47564 · Maven · Io.Netty:Netty-Codec-Haproxy

Published 2026-06-08 · Updated 2026-06-08

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When decoding a PP2 TYPE SSL TLV, HAProxyMessage.readNextTLV() first calls header.retainedSlice(header.readerIndex(), length) and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released.

Fix

Related Identifiers

GHSA-CC37-9Q2J-3HFV

Affected Products

Io.Netty:Netty-Codec-Haproxy

References · 5

• https://osv.dev/vulnerability/GHSA-cc37-9q2j-3hfv · Vendor Advisory
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note