ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10070 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +1215 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-haproxy and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

CVE-2026-44893

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls "header.retainedSliceheader.readerIndex, length" and only then...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10070 more potentially affected by CVE-2026-44893 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

CVE-2026-44893: Improper Check or Handling of Exceptional Conditions

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls header.retainedSliceheader.readerIndex, length and only then...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +1215 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-haproxy and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +1215 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-haproxy and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10070 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the parsing process of nested PP2TYPESSL TLVs within the HAProxy PROXY protocol v2 codec. An attacker can cause memory exhaustion by sending syntactically valid headers containing...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10070 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10070 more potentially affected by CVE-2026-44893 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10070 more potentially affected by CVE-2026-44893 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +1215 more potentially affected by CVE-2026-44893 via io.netty:netty-codec-haproxy (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-haproxy and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

Denial Of Service (DoS)

netty-codec-haproxy is vulnerable to Denial Of Service DoS. The vulnerability is due to a StackOverflowError in the HAProxyMessage.java as it does not properly limit the maximum nesting of TLV, allowing an attacker to cause an application crash via infinite recursion by passing a maliciously...

ai.djl.python:python (0.14.0), au.csiro.pathling:encoders (>=5.1.0, <=5.1.1) +4590 more potentially affected by CVE-2022-41881 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.85.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =5.1.0, =1.0.0, =0.0.2-alpha, =0.0.3-alpha, =0.0.10-alpha, =0.0.4-alpha, =0.3.28, =1.2.1, =1.2.1, =1.2.1, =1.0.1, =1.1.1, =1.1.3 and more Source cves: CVE-2022-41881 Source advisory: GHSA-FX2C-96VJ-985V...

ai.djl.python:python (0.14.0), au.csiro.pathling:encoders (>=5.1.0, <=5.1.1) +4590 more potentially affected by CVE-2022-41881 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.85.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =5.1.0, =1.0.0, =0.0.2-alpha, =0.0.3-alpha, =0.0.10-alpha, =0.0.4-alpha, =0.3.28, =1.2.1, =1.2.1, =1.2.1, =1.0.1, =1.1.1, =1.1.3 and more Source cves: CVE-2022-41881 Source advisory: MEND:CVE-2022-41881...