CVE-2026-55851
Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
How to fix
- netty netty4.1.136, 4.2.16 or later
- io.netty:netty-codec-haproxy4.2.16.Final, 4.1.136.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | 4.1.0 ≤ v < 4.1.136, 4.2.0 ≤ v < 4.2.16 | 4.1.136, 4.2.16 |
| io.netty:netty-codec-haproxyMaven | 4.2.0.Final ≤ v < 4.2.16.Final, 4.1.0.Final ≤ v < 4.1.136.Final | 4.2.16.Final, 4.1.136.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.