Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M
CVE-2026-55851Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
High 8.7
In plain English
A high-severity uncontrolled resource consumption in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | no fix listed | DEBIAN-CVE-2026-55851 |
| Debian:13 | netty | no fix listed | DEBIAN-CVE-2026-55851 |
| Debian:14 | netty | no fix listed | DEBIAN-CVE-2026-55851 |
| Maven | io.netty:netty-codec-haproxy | 4.2.16.Final | GHSA-q6cq-mhr2-jmr5 |
| Maven | io.netty:netty-codec-haproxy | 4.1.136.Final | GHSA-q6cq-mhr2-jmr5 |
| Ubuntu:26.10 | netty | no fix listed | UBUNTU-CVE-2026-55851 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5 x_refsource_CONFIRM
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b x_refsource_MISC
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final x_refsource_MISC