Netty’s HAProxy codec parses a PP2_TYPE_SSL TLV by first retaining a slice of the buffered data before validating that the TLV length is at least 5 bytes. If an attacker supplies a TLV with a length less than 5, the codec attempts to read a byte and a 4-byte integer that are not present, raising an IndexOutOfBoundsException. This exception propagates out of the decoder but the pre-retained slice is never released, causing a memory leak that grows each time the codec processes a malformed message.

The issue affects the netty-code-haproxy module of Netty, with vulnerable releases prior to 4.1.135.Final and 4.2.15.Final. Applications that embed those Netty versions and expose a HAProxy listener are susceptible.

The CVSS score of 7.5 indicates significant impact, while the EPSS score of less than 1% and absence from the CISA KEV catalog suggest that real‑world exploitation is currently unlikely. Based on the description, the most probable attack vector is an external client that can send HAProxy traffic to the vulnerable Netty service; such traffic may trigger the exception and gradually exhaust memory, potentially bringing the application to a halt.