CVE-2026-44893 Overview
CVE-2026-44893 is a denial-of-service vulnerability in the netty-codec-haproxy module of the Netty network application framework. The flaw resides in the HAProxyMessageDecoder component, which parses HAProxy PROXY protocol v2 (PP2) TLV headers. When decoding a PP2_TYPE_SSL TLV with a malformed length value, the decoder leaks a retained slice of the pooled cumulation buffer. Repeated exploitation exhausts direct memory on the server. The issue affects Netty versions prior to 4.1.135.Final and 4.2.15.Final. The vulnerability is tracked under [CWE-703: Improper Check or Handling of Exceptional Conditions].
Critical Impact
Remote unauthenticated attackers can trigger pooled buffer leaks in Netty-based servers using the HAProxy codec, leading to memory exhaustion and service unavailability.
Affected Products
- Netty netty-codec-haproxy versions prior to 4.1.135.Final
- Netty netty-codec-haproxy versions prior to 4.2.15.Final
- Applications and proxies embedding Netty with HAProxy PROXY protocol parsing enabled
Discovery Timeline
- 2026-06-12 - CVE-2026-44893 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-44893
Vulnerability Analysis
The vulnerability stems from incorrect ordering of buffer operations in HAProxyMessage.readNextTLV(). When the decoder encounters a PP2_TYPE_SSL TLV, it first invokes header.retainedSlice(header.readerIndex(), length) to retain a slice of the cumulation buffer. Only after that retention does it read the 1-byte client field and the 4-byte verify field from the slice.
If an attacker crafts a TLV header where the declared length is less than 5 bytes, the subsequent readByte() and readInt() calls throw an IndexOutOfBoundsException. The surrounding HAProxyMessageDecoder catches only HAProxyProtocolException, so the unchecked exception propagates up the call stack. The retained slice is never released back to the pool.
Because Netty allocates from pooled direct memory by default, each malformed connection permanently consumes a chunk of the buffer pool. Sustained traffic produces direct memory exhaustion and a denial-of-service condition on the affected service.
Root Cause
The root cause is an ordering and exception-handling defect. The retained reference is taken before the field-length validation occurs, and the decoder does not catch IndexOutOfBoundsException to release the slice on failure. This violates Netty's reference-counting contract.
Attack Vector
An unauthenticated remote attacker sends a single TCP connection carrying a HAProxy PROXY protocol v2 header with a PP2_TYPE_SSL TLV whose declared length is below 5 bytes. The malformed packet triggers the leak path. Repeated connections amplify the impact until the JVM exhausts direct memory or the process becomes unresponsive.
No authentication, user interaction, or privileges are required. Any service exposing a Netty endpoint with the HAProxy codec enabled — typically reverse proxies, ingress controllers, and gateways behind load balancers — is reachable from the network.
No verified public proof-of-concept code is available. Consult the GitHub Security Advisory GHSA-cc37-9q2j-3hfv for vendor technical details.
Detection Methods for CVE-2026-44893
Indicators of Compromise
- Recurring IndexOutOfBoundsException stack traces originating from HAProxyMessage.readNextTLV or HAProxyMessageDecoder in application logs.
- Steady growth in JVM direct memory usage (sun.misc.VM.maxDirectMemory() consumption) without a matching workload increase.
- io.netty.util.ResourceLeakDetector warnings referencing retained slices from the HAProxy codec.
- Abnormal connection patterns delivering short, malformed PROXY protocol v2 headers from a small set of source addresses.
Detection Strategies
- Enable Netty's leak detector at PARANOID level in non-production environments to surface unreleased buffers attributable to the HAProxy codec.
- Inspect ingress packet captures for PROXY protocol v2 frames containing PP2_TYPE_SSL (0x20) TLVs with declared length below 5.
- Correlate JVM direct memory metrics with HAProxy decoder exception counts in observability platforms.
Monitoring Recommendations
- Alert on sustained increases in BufferPoolMXBean direct buffer counts on Netty-based services.
- Track exception rates per decoder class and trigger alerts when HAProxyMessageDecoder errors deviate from baseline.
- Capture and review connection metadata for repeated short-lived PROXY protocol v2 sessions from the same source.
How to Mitigate CVE-2026-44893
Immediate Actions Required
- Upgrade netty-codec-haproxy to 4.1.135.Final or 4.2.15.Final across all affected services and rebuild downstream artifacts.
- Audit dependency trees for transitive Netty inclusions in frameworks such as gRPC, Vert.x, Reactor Netty, and Spring WebFlux.
- Restrict exposure of services that parse PROXY protocol v2 so that only trusted upstream load balancers can connect.
Patch Information
The Netty maintainers reordered the buffer operations and improved exception handling in the HAProxy codec. Fixed releases are available at the Netty 4.1.135.Final release notes and the Netty 4.2.15.Final release notes. The vendor advisory is published as GitHub Security Advisory GHSA-cc37-9q2j-3hfv.
Workarounds
- Disable the HAProxy codec on services that do not require PROXY protocol parsing.
- Terminate PROXY protocol at a trusted upstream component and forward sanitized traffic to Netty.
- Apply network ACLs so that only verified load balancers can establish connections to PROXY-aware listeners.
- Configure connection rate limits per source address to reduce the practical impact of buffer-leak abuse.
# Update Maven dependency to a fixed Netty version
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.1.135.Final
# Or for the 4.2 branch
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.2.15.Final
# Verify resolved version
mvn dependency:tree | grep netty-codec-haproxy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
