CVE-2026-55851

Analyzed Analyzed - Analysis Complete

Heap Overflow in Netty HAProxyMessageDecoder

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-55851

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	From 4.1.0 (inc) to 4.1.136 (exc)
netty	netty	From 4.2.0 (inc) to 4.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Netty's HAProxyMessageDecoder in versions 4.2.0.Final to 4.2.16.Final and 4.1.0.Final to 4.1.135 has a flaw in protocol version detection. It reads the 13th byte as a signed Java byte without masking, causing sign-extension when the byte is 0xFF. This leads to a collision with the decoder's need-more-data sentinel, causing unbounded memory accumulation in the cumulation buffer until direct memory exhaustion.

Detection Guidance

This vulnerability can be detected by checking the version of Netty's codec-haproxy module. If the version is between 4.1.0.Final and 4.1.135 or between 4.2.0.Final and 4.2.16.Final, the system is vulnerable.

Impact Analysis

This vulnerability can cause denial-of-service by exhausting system memory, leading to application crashes or degraded performance. It may also allow attackers to manipulate the protocol parser into processing malformed data, potentially causing unexpected behavior in network applications using Netty's HAProxy module.

Compliance Impact

This vulnerability causes unbounded memory consumption leading to denial of service, which could disrupt data processing and availability. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade Netty's codec-haproxy module to version 4.1.136.Final or later, or 4.2.16.Final or later. This resolves the issue by fixing the protocol version detection logic.

Hi! I’m here to help you understand CVE-2026-55851. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70