IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
8.7Alta

CVE-2026-48059Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 Publicada: (hace 5 meses)

Descripción

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Debilidad (CWE): CWE-401CWE-1286

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
amq streams 2.9 —
amq streams 3.2 —
cryostat 4 —
jboss enterprise application platform els 7.4 —
netty netty >= 4.2.0.Final, < 4.2.15.Final, < 4.1.135.Final
openshift ai 2.25 —
openshift devspaces 3.29 —
quarkus 3.27 —
quarkus 3.33 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat OpenShift Serverless all versions
Red Hat Red Hat AMQ Broker 7.14.1 all versions
Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 all versions
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 all versions
Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 all versions
Red Hat Red Hat build of Apache Camel - HawtIO 4 all versions
Red Hat Red Hat build of Apicurio Registry 3 all versions
Red Hat Red Hat build of Debezium 3 all versions
Red Hat Red Hat build of Quarkus 3.27.4.SP1 all versions
Red Hat Red Hat build of Quarkus 3.33.2.SP1 all versions
Red Hat Red Hat Data Grid 8.6.2 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 all versions
Red Hat Red Hat OpenShift AI 2.25 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.29 all versions
Red Hat Streams for Apache Kafka 2.9.4 all versions
Red Hat Streams for Apache Kafka 3.2.1 all versions

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.135
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.15