{"cve":"CVE-2026-44893","nvd":{"published":"2026-06-12T15:16:26.103","modified":"2026-09-18T13:18:25.080","status":"Modified","description":"Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-703","CWE-805"],"references":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv","https://access.redhat.com/errata/RHSA-2026:26017","https://access.redhat.com/errata/RHSA-2026:26018"],"products":["netty:netty"],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-44893","score":0.00617,"percentile":0.49571,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-cc37-9q2j-3hfv","url":"https://osv.dev/vulnerability/GHSA-cc37-9q2j-3hfv","summary":"Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length","modified":"2026-09-10T03:51:08.505489734Z","packages":[{"ecosystem":"Maven","name":"io.netty:netty-codec-haproxy","purl":"pkg:maven/io.netty/netty-codec-haproxy","ranges":[">=4.2.0.Final <4.2.15.Final"],"fixed":["4.2.15.Final"]},{"ecosystem":"Maven","name":"io.netty:netty-codec-haproxy","purl":"pkg:maven/io.netty/netty-codec-haproxy","ranges":["<4.1.135.Final"],"fixed":["4.1.135.Final"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}