CVE-2026-44893

Fixed in a distro release EPSS <1%CVSS 7.5

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Published 2026-06-12 · CVE record · OSV

Products: netty, Red Hat Cryostat 4 on RHEL 9, Red Hat AMQ Broker 7.14.1, Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat build of Quarkus 3.27.4.SP1, Red Hat build of Quarkus 3.33.2.SP1, Red Hat Data Grid 8.6.2, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9, Red Hat JBoss Enterprise Application Platform 8.1, Red Hat Streams for Apache Kafka 2.9.4, Red Hat Streams for Apache Kafka 3.2.1, Red Hat OpenShift AI 2.25, Red Hat OpenShift Dev Spaces 3.29, Red Hat OpenShift Serverless, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Satellite 6, Red Hat Single Sign-On 7

Fixed upstream

Distro releases