CVE-2026-44893

ADVISORY - github

Summary

When decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls header.retainedSlice(header.readerIndex(), length) and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released.

EPSS Score⁠: 0.00426 (0.340)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-703⁠

Improper Check or Handling of Exceptional Conditions

ADVISORY - github

CWE-703⁠

Improper Check or Handling of Exceptional Conditions

ADVISORY - redhat

CWE-805⁠

Buffer Access with Incorrect Length Value

Impacted images

Advisories

NIST

CREATED

13 days ago

UPDATED

11 days ago

ADVISORY IDCVE-2026-44893⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-703⁠

CVSS SCORE

7.5high

GitHub

CREATED

17 days ago

UPDATED

13 days ago

ADVISORY IDGHSA-cc37-9q2j-3hfv⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-703⁠

CVSS SCORE

7.5high

Debian

CREATED

13 days ago

UPDATED

12 days ago

ADVISORY IDCVE-2026-44893⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

10 days ago

UPDATED

10 days ago

ADVISORY IDCVE-2026-44893⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Red Hat

CREATED

13 days ago

UPDATED

12 days ago

ADVISORY IDCVE-2026-44893⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-805⁠

CVSS SCORE

7.5high

Chainguard

CREATED

21 hours ago

UPDATED

21 hours ago

ADVISORY ID

CGA-795q-wfg5-7j94

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

16 days ago

UPDATED

16 days ago

ADVISORY ID

MINI-5mcr-4xx5-w3gr

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

4 days ago

UPDATED

4 days ago

ADVISORY ID

MINI-6g92-r76h-gj28

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

8 days ago

UPDATED

8 days ago

ADVISORY ID

MINI-739g-2gcg-8v79

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

8 days ago

UPDATED

8 days ago

ADVISORY ID

MINI-7wcj-hqm4-ghgw

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-8j3p-5rg3-49c6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-9859-p6rq-c74w

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-jvfc-988v-2jqm

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

4 days ago

UPDATED

4 days ago

ADVISORY ID

MINI-m4qr-6pcg-95g7

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

8 days ago

UPDATED

8 days ago

ADVISORY ID

MINI-qfhq-m86f-6vmh

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

16 days ago

UPDATED

16 days ago

ADVISORY ID

MINI-qgq4-2rfr-4f53

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-r9cf-9mfh-ghrf

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-v6j2-6x8w-fw84

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

16 days ago

UPDATED

16 days ago

ADVISORY ID

MINI-vgq5-p8qx-rv46

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY