When decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls "header.retainedSlice(header.readerIndex(), length)" and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released.