Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-12T14:00:25 netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-805

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 2026-06-17T00:00:00Z RHSA-2026:26586 netty-codec-haproxy Red Hat build of Quarkus 3.27.4.SP1 2026-06-17T00:00:00Z RHSA-2026:26018 netty-codec-haproxy Red Hat build of Quarkus 3.33.2.SP1 2026-06-17T00:00:00Z RHSA-2026:26017 netty-codec-haproxy Cryostat 4 Affected netty-codec-haproxy OpenShift Serverless Affected openshift-serverless-1/kn-ekb-dispatcher-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-receiver-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 Red Hat AMQ Broker 7 Affected netty-codec-haproxy Red Hat build of Apache Camel 4 for Quarkus 3 Affected netty-codec-haproxy Red Hat build of Apache Camel for Spring Boot 4 Affected netty-codec-haproxy Red Hat build of Apache Camel - HawtIO 4 Affected netty-codec-haproxy Red Hat build of Apicurio Registry 3 Affected netty-codec-haproxy Red Hat build of Debezium 3 Will not fix netty-codec-haproxy Red Hat Build of Keycloak Affected netty-codec-haproxy Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9 Red Hat Build of Keycloak Not affected rhbk/keycloak-rhel9-operator Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Build of Keycloak Not affected rhbk-rhel9-operator/rhbk-rhel9-operator Red Hat Data Grid 8 Affected netty-codec-haproxy Red Hat Fuse 7 Will not fix netty-codec-haproxy Red Hat JBoss Enterprise Application Platform 7 Affected netty-codec-haproxy Red Hat JBoss Enterprise Application Platform Expansion Pack Affected netty-codec-haproxy Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/multicluster-redirector-rhel9 Red Hat Satellite 6 Not affected candlepin Red Hat Single Sign-On 7 Not affected netty-codec-haproxy streams for Apache Kafka 2 Affected netty-codec-haproxy streams for Apache Kafka 3 Affected netty-codec-haproxy https://www.cve.org/CVERecord?id=CVE-2026-44893 https://nvd.nist.gov/vuln/detail/CVE-2026-44893 https://github.com/netty/netty/releases/tag/netty-4.1.135.Final https://github.com/netty/netty/releases/tag/netty-4.2.15.Final https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv