-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty:netty-codec-haproxy | maven | < 4.1.86.Final | 4.1.86.Final |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled recursion when parsing PP2_TYPE_SSL TLVs. The description explicitly states that nested SSL TLVs can be infinitely chained within each other, limited only by the 0xffff length constraint. The decodeTlvs function (or equivalent TLV parsing logic) in HAProxyMessageDecoder would be responsible for recursively processing these TLVs. Since there's no mention of recursion depth checks in the advisory, and the CWE is specifically about uncontrolled recursion, this function's handling of SSL TLV nesting constitutes the vulnerable path.
Ongoing coverage of React2Shell