CVE-2026-48059 netty CVE debrief

Who should care

Defenders responsible for Netty deployments, especially those with untrusted or external clients, should assess exposure and apply patches or mitigations. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams who need to prioritize patching or mitigating this vulnerability, especially in environments where Netty is used with untrusted or external clients. The vulnerability can lead to

Why it matters

CVE-2026-48059 is a memory leak vulnerability in the HAProxy PROXY protocol v2 codec in Netty. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Netty is used with untrusted or external clients. The vulnerability can lead to resource exhaustion and performance degradation, and may allow for denial-of-service (DoS) attacks. Affected versions require verification and patch application to prevent exploitation.

• Memory leak can lead to resource exhaustion and performance degradation.
• Potential for denial-of-service (DoS) attacks through exploitation of this vulnerability.
• Requires verification of affected versions and patch application to prevent exploitation.
• May require monitoring and validation of client input to detect and prevent attacks.

Technical summary

The HAProxy PROXY protocol v2 codec in Netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs at depth two or greater. This occurs on the successful parse path, with no exception thrown, and the message fires downstream. The decoder removes itself, and the application releases the `HAProxyMessage` normally. However, the underlying cumulation buffer remains permanently pinned.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Netty is used with untrusted or external clients.

Recommended defensive actions

• Assess exposure and apply patches (versions 4.1.135.Final or 4.2.15.Final) to vulnerable Netty deployments.
• Implement compensating controls, such as validating client input and monitoring for suspicious activity.
• Verify the effectiveness of existing security measures, such as firewalls and intrusion detection systems.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Vendor advisories and release notes also confirm the issue and provide patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.