Netty, a network application framework, has a flaw in its HAProxy PROXY protocol v2 decoder where nested PP2_TYPE_SSL type-length-value records at depth two or greater cause a subtle reference‑count leak. The decoder processes the header without throwing an exception, forwards the message downstream, and normally releases the HAProxyMessage object, yet the underlying pooled buffer remains permanently pinned. This results in a memory leak that can deplete either native or heap memory, potentially leading to application slowdown, out‑of‑memory errors, or restart. The weakness is a classic memory‑management defect under CWE‑401 and a reference‑count management error under CWE‑1286.

The vulnerability affects the Netty library, specifically all versions prior to 4.1.135.Final and 4.2.15.Final. Any application that integrates Netty and uses the HAProxy PROXY protocol v2 support is in scope; updating to the patched releases removes the issue.

At a CVSS score of 8.7 the vulnerability is high severity. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the flaw is not listed in CISA KEV, so there are no publicly known exploits currently. The likely attack vector is remote: an attacker can connect to a Netty‑based service that exposes the HAProxy v2 codec and send a specially crafted header with nested SSL TLVs. The memory exhaustion can be triggered repeatedly, making it a denial‑of‑service attack that targets resource availability rather than confidentiality or integrity.