AIKIDO-2026-710075
netty-codec-haproxy is vulnerable to Memory Leak
53
Medium Risk
This Affects:
netty-codec-haproxyTL;DR
A prior fix added recursive release of PROXY protocol v2 TLV buffers but missed one error path. When HAProxyMessage.readNextTLV catches an exception during nested SSL TLV parsing, it releases the TLV list without descending into grandchild entries, leaving grandchild ByteBuf slices retained. Each crafted PROXY-v2 header leaks a grandchild slice and pins the underlying pooled buffer, so sustained malformed headers accumulate pinned memory and exhaust it. The fix releases the encapsulated TLVs recursively.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses PROXY protocol v2 headers from untrusted sources.
Background info
netty-codec-haproxy is vulnerable to Memory Leak in versions 0.0.1 - 4.1.137.Final and 0.0.1 - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-codec-haproxy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.