Cloudanix VulnDB

CVE-2026-55851

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Jul 21, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a widely used network library lets remote attackers crash servers by sending specially crafted network messages that fill up memory until the program dies.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The HAProxyMessageDecoder reads the 13th byte of a PROXY protocol v2 header as a signed byte, sign-extends 0xFF to -1, collides with the ByteToMessageDecoder need-more-data sentinel, and causes unbounded growth of the cumulation buffer until direct memory exhaustion.

Why it matters to the business

Services built on affected Netty versions can be crashed via remote memory exhaustion, producing availability loss for any application that accepts HAProxy PROXY protocol traffic; the flaw has been public for 97 days with low but non-zero exploit probability.

How an attack unfolds

An attacker sends a PROXY protocol v2 header whose version byte is 0xFF; the decoder misclassifies the packet, repeatedly requests more data, and accumulates inbound bytes without bound until the JVM runs out of direct memory.

How to fix it

Upgrade Netty codec-haproxy to 4.1.136.Final or 4.2.16.Final; Red Hat customers must apply RHSA-2026:54622.

How to confirm the fix worked

Confirm the running Netty codec-haproxy jar version is at or above 4.1.136.Final / 4.2.16.Final and that the HAProxyMessageDecoder no longer treats 0xFF as a sentinel value.

Typical attack path

  1. Establish a TCP connection to a Netty-based server that enables the codec-haproxy module
  2. Send a minimal PROXY protocol v2 binary prefix ending with version byte 0xFF
  3. Continue sending additional data to keep the decoder in the accumulation loop
  4. Trigger OutOfMemoryError and service termination

How to detect it

Monitor JVM heap and direct-memory metrics for sudden unbounded growth on hosts running Netty; inspect application logs for repeated HAProxyMessageDecoder warnings or stack traces containing ByteToMessageDecoder.cumulate.

What your security team should do

  • Immediately upgrade all Netty instances to the fixed releases listed in RHSA-2026:54622
  • Disable HAProxy PROXY protocol support where it is not required
  • Add memory-usage and OOM alerts for Java processes that terminate inbound HAProxy connections
  • Review downstream dependencies for any remaining vulnerable Netty versions

The record

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities