PT-2026-48809 · Netty · Netty

Published 2026-06-11 · Updated 2026-06-12 · CVE-2026-48059

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final

Description The HAProxy PROXY protocol v2 codec leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested PP2 TYPE SSL TLVs (type-length-value records) at depth two or greater. This occurs during the successful parse path where the underlying cumulation buffer, a pooled and potentially direct ByteBuf allocated by the channel, remains permanently pinned even after the HAProxyMessage is released and the decoder removes itself.

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-48059

GHSA-H2QV-FJ59-J46J

Affected Products

Netty

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-48059 · Security Note
• https://osv.dev/vulnerability/GHSA-h2qv-fj59-j46j · Vendor Advisory
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j · Note
• https://reddit.com/r/VulnMatter/comments/1u3zcij/resumen_diario_de_vulnerabilidades_12062026 · Reddit Post