CVE-2026-48059: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

Synopsis

An unbalanced reference count bug in the Netty HAProxy PROXY protocol v2 codec causes a permanent memory leak on every affected connection. The vulnerability is reachable over the network with no authentication required: any client that sends a syntactically valid PROXY protocol v2 header containing nested PP2_TYPE_SSL TLV records at depth two or greater triggers the leak. Successful exploitation exhausts available native or heap memory, crashing or severely degrading the affected service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream publishes a fix for the affected version range.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable codec is exposed over the network; an attacker must be able to open a TCP connection to the service and send a crafted PROXY protocol v2 header.

• AuthenticationNot required

  No credentials or session token are needed; any unauthenticated client connection is sufficient to trigger the leak.

• Victim interactionNot required

  No user or operator action is required; the attacker sends the malformed header autonomously.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: the trigger is a syntactically valid header with nested TLVs, requiring no race conditions, memory-layout guessing, or environmental preconditions.

Blast Radius

• Each crafted connection permanently pins a pooled ByteBuf allocation, preventing the allocator from reclaiming that memory for the lifetime of the process.
• An attacker who repeatedly opens connections exhausts the native or heap memory pool available to the JVM, causing allocation failures across all threads.
• Once memory is exhausted the service crashes or becomes unable to accept new connections, producing a complete denial of service for all users of the affected application.