CVE-2026-93564: Netty HAProxy PROXY-v2 DoS Vulnerability

CVE-2026-93564 Overview

A reference-count leak in the Netty HAProxy PROXY-v2 message decoder allows remote, unauthenticated attackers to trigger memory exhaustion. The flaw resides in how Netty's HAProxyMessageDecoder handles specially crafted PROXY-protocol v2 headers. Each malformed message leaks reference-counted buffers, gradually depleting available memory on the target process. Sustained exploitation results in a Denial of Service (DoS) against any service that terminates PROXY-protocol connections through Netty. The weakness is categorized under [CWE-1035] (relative to OWASP Top Ten known vulnerable components) and affects distributions shipping vulnerable Netty releases, including multiple Red Hat products tracked in advisories RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257.

Critical Impact
Unauthenticated remote attackers can exhaust JVM heap memory on Netty-based services by streaming crafted PROXY-v2 headers, causing sustained Denial of Service.

Affected Products

Netty framework versions containing the vulnerable HAProxyMessageDecoder implementation
Red Hat products covered by advisory RHSA-2026:69440
Red Hat products covered by advisories RHSA-2026:69470 and RHSA-2026:70257

Discovery Timeline

2026-09-18 - CVE-2026-93564 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93564

Vulnerability Analysis

Netty is a high-performance asynchronous network application framework used by JVM services to terminate TCP and HTTP traffic. The HAProxy PROXY protocol allows an upstream load balancer to convey the original client address to a backend. Netty implements this through HAProxyMessageDecoder, which parses both v1 (text) and v2 (binary) PROXY headers into pooled ByteBuf structures.

The decoder fails to release reference-counted buffers along specific error or edge-case paths when parsing v2 headers. Because Netty uses manual reference counting on pooled direct memory, each leaked buffer withholds native memory that the allocator cannot reclaim. Attackers can automate the connection pattern from any source that can reach the listening port, requiring no authentication or user interaction.

Root Cause

The root cause is improper lifecycle management of ByteBuf objects inside the HAProxy v2 decode path. When the decoder aborts processing on a malformed or truncated v2 header, it exits without invoking ReferenceCountUtil.release() on the associated buffer, leaving the reference count above zero. This maps to [CWE-1035], reflecting reliance on a component with a known weakness in resource handling.

Attack Vector

Exploitation requires only network reachability to a Netty service that has the HAProxy codec enabled in its pipeline. An attacker opens TCP connections and sends crafted PROXY-v2 preambles that trigger the leaking code path. Repeating this pattern across many connections drains heap and native memory until the service throws OutOfMemoryError or becomes unresponsive. See the Red Hat CVE Analysis for CVE-2026-93564 for additional technical context.

Detection Methods for CVE-2026-93564

Indicators of Compromise

Steady growth in JVM heap or native (direct) memory usage on services that accept PROXY-protocol traffic, without a corresponding rise in application-level request volume.
Repeated LEAK warnings emitted by Netty's ResourceLeakDetector referencing HAProxyMessageDecoder or pooled ByteBuf allocations.
OutOfMemoryError events or container restarts affecting services fronted by an HAProxy or load-balancer terminator that forwards PROXY-v2 headers.

Detection Strategies

Enable Netty's resource leak detector at PARANOID level in non-production environments and ADVANCED in production to log stack traces for unreleased buffers.
Correlate connection spikes from single or small sets of source IPs with abnormal heap growth on Netty-based listeners.
Alert on repeated malformed PROXY-v2 parse failures logged by upstream proxies or the Netty pipeline.

Monitoring Recommendations

Track JVM metrics (jvm.memory.used, netty.direct.memory, GC frequency) per service and baseline against normal traffic.
Monitor Red Hat errata channels (RHSA-2026:69440, RHSA-2026:69470, RHSA-2026:70257) for updated package versions.
Ingest network telemetry to identify sustained connection floods targeting ports where PROXY-v2 termination is enabled.

How to Mitigate CVE-2026-93564

Immediate Actions Required

Inventory all Java services that embed Netty and enable HAProxyMessageDecoder in their channel pipelines.
Apply vendor updates referenced in RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257 as soon as they are available for the affected distributions.
Restrict inbound access to Netty listeners so that only trusted load balancers can send PROXY-protocol traffic.

Patch Information

Red Hat has published fixes through advisories RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257. Additional analysis is available in the Red Hat CVE Analysis and Red Hat Bug Report #2536953. Upgrade Netty to a release that includes the corrected HAProxyMessageDecoder reference-count handling.

Workarounds

Disable the HAProxy codec in Netty pipelines where PROXY-protocol termination is not strictly required.
Terminate PROXY-protocol traffic at a hardened upstream proxy that rejects malformed v2 headers before they reach the Netty listener.
Enforce per-source connection rate limits at the network edge to blunt memory-exhaustion attempts while patching is scheduled.

bash

# Configuration example: restrict PROXY-v2 sources with iptables
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP