CVE-2026-48059: 
Java vulnerability analysis and mitigation

CVE-2026-48059 is a memory exhaustion vulnerability in Netty's HAProxy PROXY protocol v2 codec, titled "Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion." It affects io.netty:netty-codec-haproxy versions up to and including 4.1.134.Final and 4.2.0.Final through 4.2.14.Final. The vulnerability was published by the Netty project on June 5, 2026, with the GitHub Advisory Database entry updated June 12, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Netty Security Advisory).

The root cause is an unbalanced reference count (CWE-401: Missing Release of Memory after Effective Lifetime) in the HAProxy PROXY protocol v2 TLV parser. When a client sends a syntactically valid PROXY protocol v2 header containing nested PP2_TYPE_SSL TLVs at depth two or greater, the parser successfully processes the message — no exception is thrown, the decoded HAProxyMessage is passed downstream, and the decoder removes itself — but the underlying pooled cumulation ByteBuf (which may be a direct/native buffer) is never released, leaving it permanently pinned (GitHub Advisory). The flaw is also classified under CWE-1286 (Improper Validation of Syntactic Correctness of Input). The fix, contributed by normanmaurer, is tracked in pull request #16881 ("HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs") and #16866 ("HAProxy: Reject HAProxyMessages with malformated TLV and not leak memory") (Netty 4.1.135 Release).

Successful exploitation causes a per-connection native or heap memory leak, allowing an unauthenticated remote attacker to progressively exhaust the JVM heap or native memory of the affected Netty application by repeatedly establishing connections with crafted PROXY protocol v2 headers. Over time, this leads to application crashes or complete unresponsiveness (denial of service). There is no confidentiality or integrity impact; the vulnerability is purely an availability concern (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker against services that accept HAProxy PROXY protocol v2 connections. The EPSS score is approximately 0.609% (44th percentile), indicating a relatively low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Reconnaissance: Identify services using Netty with HAProxy PROXY protocol v2 support enabled (e.g., load-balanced Java applications, gRPC services, or reverse-proxied microservices). Tools like Shodan or Censys can help locate exposed endpoints.
2. Craft malicious PROXY protocol v2 header: Construct a syntactically valid PROXY protocol v2 binary header that includes nested PP2_TYPE_SSL TLV records at depth two or greater. The header must be well-formed enough to pass initial parsing without triggering an exception.
3. Establish repeated connections: Send the crafted header to the target service on each new TCP connection. Each connection causes the cumulation ByteBuf to be permanently pinned in memory without release.
4. Exhaust memory: Repeat the connection cycle at high frequency to progressively consume native or heap memory, eventually causing the JVM to run out of memory and the application to crash or become unresponsive (GitHub Advisory, Netty 4.1.135 Release).

• Network: High volume of short-lived TCP connections to the service port from one or more source IPs, particularly if the connections terminate immediately after the PROXY protocol handshake.
• Application Metrics: Steadily increasing JVM heap or native (direct) memory usage over time without corresponding increase in application load; frequent or growing OutOfMemoryError events in application logs.
• Logs: JVM garbage collection logs showing increasing old-gen or direct memory pressure; application logs showing OutOfMemoryError: Direct buffer memory or similar native memory exhaustion errors.
• Process: JVM process memory footprint growing unboundedly; increased frequency of full GC cycles without memory recovery (GitHub Advisory).

Upgrade io.netty:netty-codec-haproxy to version 4.1.135.Final or 4.2.15.Final, which contain the fix for this vulnerability (Netty 4.1.135 Release, Netty 4.2.15 Release). Red Hat has also issued security errata (RHSA-2026:26017, RHSA-2026:26018, RHSA-2026:26586) for affected products, and IBM has published a bulletin for IBM Enterprise Build of Quarkus (Red Hat CVE, IBM Advisory). As a temporary workaround where patching is not immediately possible, restrict network access to PROXY protocol endpoints to trusted upstream load balancers only, and implement connection rate limiting to reduce the rate of memory exhaustion.

Red Hat acknowledged the vulnerability and assigned it a Moderate severity rating, issuing multiple errata for affected products including Red Hat Build of Quarkus and Apache Camel (Red Hat CVE). IBM published a security bulletin noting that IBM Enterprise Build of Quarkus is affected (IBM Advisory). The vulnerability was part of a large batch of security fixes released simultaneously in Netty 4.1.135.Final and 4.2.15.Final, covering over a dozen CVEs, which drew attention from the Java/JVM security community (Netty 4.2.15 Release).