Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty:netty-codec-haproxy | maven | >= 4.2.0.Final, <= 4.2.14.Final | 4.2.15.Final |
| io.netty:netty-codec-haproxy | maven | <= 4.1.134.Final | 4.1.135.Final |
Miggo AIRoot Cause AnalysisThe core of the vulnerability lies in the io.netty.handler.codec.haproxy.HAProxyMessage.readNextTLV function. When parsing a PP2_TYPE_SSL TLV from an HAProxy protocol message, the code would call header.retainedSlice() to get the TLV's content before validating that the specified length was sufficient to contain the required fields (a 1-byte client field and a 4-byte verify field).
An attacker could craft a malicious HAProxy message with a PP2_TYPE_SSL TLV advertising a length less than 5. When readNextTLV attempted to read the client and verify fields from the undersized slice, it would throw an IndexOutOfBoundsException. The HAProxyMessageDecoder, which is the top-level decoder in the channel pipeline, was only designed to catch HAProxyProtocolException. As a result, the IndexOutOfBoundsException would propagate up, and the ByteBuf slice that was retained earlier would never be released, causing a memory leak. Each malicious message would leak a small amount of memory, which could accumulate over time and lead to a denial-of-service by exhausting the server's memory.
The patch addresses this by first validating the TLV length. If the length is invalid, it now throws a HAProxyProtocolException, which is correctly handled by the decoder. Additionally, the code was changed to use header.slice() instead of retainedSlice(), and only explicitly call .retain() on the slice after all parsing and validation steps have successfully completed, preventing the leak.
io.netty.handler.codec.haproxy.HAProxyMessage.readNextTLVcodec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java
io.netty.handler.codec.haproxy.HAProxyMessage.readTlvscodec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java
io.netty.handler.codec.haproxy.HAProxyMessage.deallocatecodec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java