Junglewise Threat Intelligence

CVE-2026-55851: Netty uncontrolled resource consumption in HAProxyMessageDecoder

CVE-2026-55851 · Severity: high · CVSS 4 · Published 2026-07-21

Vendors: Netty.

Executive brief

Netty is a widely used networking framework for Java applications. A vulnerability in its HAProxy protocol module allows a remote attacker to crash a server by sending a specially crafted data packet. This causes the server to consume all available memory, leading to a denial-of-service (DoS) condition that disrupts operations and availability.

Technical details

The HAProxyMessageDecoder in Netty's codec-haproxy module incorrectly handles protocol version detection by reading the 13th byte as a signed Java byte and widening it to an integer without masking. An attacker can send a PROXY protocol v2 binary prefix followed by a version byte of 0xFF, which sign-extends to -1. This value collides with the decoder's internal 'need more data' sentinel. This collision traps the decoder in a loop where it continuously requests more data without consuming bytes or enforcing header size limits, leading to unbounded accumulation in the cumulation buffer and JVM direct memory exhaustion. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected products

  • Netty netty-codec-haproxy >= 4.1.0.Final, <= 4.1.135.Final
  • Netty netty-codec-haproxy >= 4.2.0.Final, <= 4.2.15.Final

Timeline

  • 2026-07-14: disclosed: Initial disclosure by maintainers
  • 2026-07-21: advisory: NVD publication
  • 2026-07-22: advisory: GitHub Advisory reviewed

References