Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-10T00:46:51 io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-1035

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Important. It allows a remote, unauthenticated attacker to cause a denial of service by sending specially crafted PROXY-protocol v2 headers to a service utilizing the `netty-codec-haproxy` component. Repeated malformed requests can lead to memory exhaustion due to a reference-count leak in the `HAProxyMessageDecoder`, impacting the availability of affected Red Hat products. See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance. Red Hat AMQ Broker 7 Affected netty-codec-haproxy Red Hat build of Apache Camel 4 for Quarkus 3 Affected netty-codec-haproxy Red Hat build of Apache Camel for Spring Boot 4 Affected netty-codec-haproxy Red Hat build of Apicurio Registry 3 Affected netty-codec-haproxy Red Hat build of Debezium 3 Affected netty-codec-haproxy Red Hat Build of Keycloak Affected netty-codec-haproxy Red Hat Fuse 7 Fix deferred netty-codec-haproxy Red Hat JBoss Enterprise Application Platform 7 Fix deferred netty-codec-haproxy Red Hat Single Sign-On 7 Fix deferred netty-codec-haproxy https://www.cve.org/CVERecord?id=CVE-2026-93564 https://nvd.nist.gov/vuln/detail/CVE-2026-93564