CVE-2026-44893— Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44893
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
Source: CVE Program / CVE List V5
Vulnerability Description
Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对异常条件检查或处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Netty 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Netty是Netty团队开源的一款非阻塞I/O客户端-服务器框架, 它主要用于开发Java网络应用程序,如协议服务器和客户端等。 Netty存在异常处理不当漏洞，该漏洞源于netty-codec-haproxy中HAProxyMessage.readNextTLV方法在解码PP2_TYPE_SSL TLV时异常处理不当，可能导致内存泄露。以下版本受到影响：4.1.135.Final之前版本和4.2.15.Final之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44893
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 13322 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-44893
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44893 (1)
Vendor Pages for CVE-2026-44893 (2)
Same Patch Batch · netty · 2026-06-12 · 19 CVEs total
| CVE-2026-45674 | 8.7 HIGH | Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records |
| CVE-2026-47691 | 8.7 HIGH | Netty has Insufficient Bailiwick Validation for NS Records |
| CVE-2026-48059 | 8.7 HIGH | Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memo |
| CVE-2026-48006 | 8.7 HIGH | Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator |
| CVE-2026-44892 | 7.5 HIGH | Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounde |
| CVE-2026-44894 | 7.5 HIGH | Netty's Default QUIC token handler accepts any client-supplied token |
| CVE-2026-46340 | 7.5 HIGH | Netty: SCTP reassembly nests buffers without bound |
| CVE-2026-50011 | 7.5 HIGH | Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length |
| CVE-2026-50010 | 7.5 HIGH | Netty's wrapping plain trust manager silently disables hostname verification |
| CVE-2026-48748 | 7.5 HIGH | Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion |
| CVE-2026-45416 | 7.5 HIGH | Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes |
| CVE-2026-45673 | 6.8 MEDIUM | Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port |
| CVE-2026-48043 | 5.3 MEDIUM | netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Lea |
| CVE-2026-47244 | 5.3 MEDIUM | Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced |
| CVE-2026-50020 | 5.3 MEDIUM | Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRL |
| CVE-2026-50009 | 4.8 MEDIUM | Netty QUIC stateless reset token material exposed through header-visible connection IDs |
| CVE-2026-45536 | 4.0 MEDIUM | Netty: Unix-socket fd receive leaks descriptors when peer sends two at once |
| CVE-2026-50560 | Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature |
IV. Related Vulnerabilities
Same product: netty
- CVE-2026-59898
Netty: WebSockets V07/V08 handshaker missing Connection/Upgr - CVE-2026-59899
Netty HttpContentEncoder: Unbounded Per-Connection Queue Gro - CVE-2026-59900
Netty codec-http2: Lack of Host Header Deduplication in HTTP - CVE-2026-59901
Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads - CVE-2026-59919
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Addres
Same vendor: netty
- CVE-2026-59898
Netty: WebSockets V07/V08 handshaker missing Connection/Upgr - CVE-2026-59899
Netty HttpContentEncoder: Unbounded Per-Connection Queue Gro - CVE-2026-59900
Netty codec-http2: Lack of Host Header Deduplication in HTTP - CVE-2026-59901
Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads - CVE-2026-59919
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Addres
Same weakness: CWE-703
- CVE-2026-16218
hunvreus devpush Storage Reset Failure storage.py reset_stor - CVE-2026-20187
Cisco RoomOS Security Hardening Release - Exceptional Condit - CVE-2026-56338
Capgo - Denial of Service in 2FA Email Verification via /aut - CVE-2026-47316
SAMSUNG Escargot 安全漏洞 - CVE-2026-34388
Fleet vulnerable to Denial of Service via unhandled gRPC log
V. Comments for CVE-2026-44893
No comments yet