EUVD-2026-46438

Netty: codec-haproxy Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion...

PT-2026-62225

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.134 Netty versions 4.2.0.Final through 4.2.15 Description The HAProxyMessageDecoder in the codec-haproxy module performs protocol version detection by reading the 13th byte as a signed Java byte and...

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested PP2TYPESSL TLVs type-length-value records at depth two or greater. The leak occurs on the successful parse path — no exception is...

PT-2026-47564

When decoding a PP2 TYPE SSL TLV, HAProxyMessage.readNextTLV first calls header.retainedSliceheader.readerIndex, length and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsExceptio...