CVE-2026-55851
highpriority · track · 30EPSS 0.006 · 50 %ileDEEUFRUSEPSS · scored 2026-10-27
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (16)
Products and version ranges known to be affected.
- IBM App Connect Enterprise for Manufactoringall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:for_manufactoring
- Maven io.netty:netty-codec-haproxy4.1.0.Final → 4.1.136.FinalosvUSpkg:maven/io.netty/netty-codec-haproxy
- Maven io.netty:netty-codec-haproxy4.2.0.Final → 4.2.16.FinalosvUSpkg:maven/io.netty/netty-codec-haproxy
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2356Netty: Mehrere SchwachstellenDeutsch2026-07-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.
- GHSA-q6cq-mhr2-jmr5Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion2026-07-22ghsa · osvUS
The `HAProxyMessageDecoder` in netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte of the inbound stream as a signed Java `byte` and widening it to `int` without masking. When an attacker sends a PROXY protocol v2 binary prefix (`0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A`) followed by version byte `0xFF`, the sign extension produces `-1`, which collides with the decoder's "need more data" sentinel value. This collision traps the decoder in a version-detection loop where it perpetually requests more data without consuming any bytes, never instantiates the `HeaderExtractor` that enforces header size limits, and causes `ByteToMessageDecoder` to accumulate all subsequent inbound bytes into an unbounded `cumulation` buffer until the JVM exhausts its direct memory allocation.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (16)
External citations — patches, advisories, analysis.
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bcnnvd
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6cnnvd
- https://github.com/netty/netty/releasesPatchcnnvd
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Finalcnnvd
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Finalcnnvd
- https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5cnnvd
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003benisa_euvd
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan