CVE-2026-55851: Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by reading the 13th byte as a signed Java byte and widening it to int without masking; a PROXY protocol v2 binary prefix followed by version byte 0xFF sign-extends to -1, collides with the decoder's need-more-data sentinel, and causes ByteToMessageDecoder to accumulate inbound bytes in an unbounded cumulation buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Other sources
The HAProxyMessageDecoder in netty's codec-haproxy module performs protocol version detection by reading the 13th byte of the inbound stream as a signed Java byte and widening it to int without masking. When an attacker sends a PROXY protocol v2 binary prefix (0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A) followed by version byte 0xFF, the sign extension produces -1, which collides with the decoder's "need more data" sentinel value. This collision traps the decoder in a version-detection loop where it perpetually requests more data without consuming any bytes, never instantiates the HeaderExtractor that enforces header size limits, and causes ByteToMessageDecoder to accumulate all subsequent inbound bytes into an unbounded cumulation buffer until the JVM exhausts its direct memory allocation.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-codec-haproxyto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
maven/io.netty:netty-codec-haproxyto a version that resolves this vulnerability.Fixed in 4.2.16.Final - Upgrade
Upgrade
Netty codec-haproxy (HAProxyMessageDecoder)to a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
Netty codec-haproxy (HAProxyMessageDecoder)to a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55851?
CVE-2026-55851 has a high severity rating of 8.7 according to the CVSS scoring system.
How does CVE-2026-55851 affect systems?
CVE-2026-55851 can lead to unbounded memory exhaustion due to a signed-byte sentinel collision in the HAProxyMessageDecoder.
What versions of Netty are impacted by CVE-2026-55851?
CVE-2026-55851 affects Netty versions from 4.2.0.Final up to but not including 4.2.16.Final and from 4.1.0.Final up to but not including 4.1.135.
How do I fix CVE-2026-55851?
To fix CVE-2026-55851, upgrade to the latest versions of Netty that are beyond the impacted versions.
Is CVE-2026-55851 a known issue in previous releases of Netty?
Yes, CVE-2026-55851 is a known vulnerability identified in specific releases of the Netty codec-haproxy module.