Memory Exhaustion Vulnerability in Netty's HAProxyMessageDecoder
CVE-2026-55851
8.7HIGH
What is CVE-2026-55851?
The Netty framework has a flaw in its HAProxyMessageDecoder's protocol version detection mechanism. In specified versions, the decoder improperly handles the version byte of the PROXY protocol v2 binary prefix, causing it to incorrectly signal a need for more data. This results in unbounded accumulation of inbound bytes in a cumulative buffer, leading to potential exhaustion of direct memory resources. Users are advised to upgrade to at least versions 4.1.136.Final or 4.2.16.Final to mitigate this risk.
Affected Version(s)
netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final
netty >= 4.1.0.Final, < 4.1.136.Final < 4.1.0.Final, 4.1.136.Final