A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
red hat:red hat amq broker 7
red hat:red hat build of debezium 3
red hat:red hat build of apache camel 4 for quarkus 3
red hat:red hat fuse 7
red hat:red hat build of apache camel for spring boot 4
red hat:red hat jboss enterprise application platform 7
red hat:red hat build of apicurio registry 3
red hat:red hat build of keycloak
red hat:red hat single sign-on 7
References 6
https://access.redhat.com/security/cve/CVE-2026-93564
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2536953
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:69470
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:69440
RHSA-2026:69440
https://access.redhat.com/errata/RHSA-2026:70257
RHSA-2026:70257
https://access.redhat.com/errata/RHSA-2026:83612
secalert@redhat.com