Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-55851: Netty codec-haproxy can consume unlimited memory
CVE-2026-55851 · published 3 months ago
Summary
Versions of Netty that include the codec‑haproxy module may keep adding incoming data to a buffer without limit when they receive a specially crafted HAProxy message. This can eventually use up all available memory, causing the application to slow down or crash. Upgrade to Netty 4.1.136.Final, 4.2.16.Final or later, or apply the vendor’s patch to stop the memory growth.
What to do
- Update netty io.netty:netty-codec-haproxy to version 4.2.16.Final.
- Update netty io.netty:netty-codec-haproxy to version 4.1.136.Final.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | netty | netty |
>= 4.2.0.Final, < 4.2.16.Final >= 4.1.0, < 4.1.136 >= 4.2.0, < 4.2.16 |
| maven | netty | io.netty:netty-codec-haproxy |
>= 4.2.0.Final, <= 4.2.15.Final >= 4.1.0.Final, <= 4.1.135.Final Fix: upgrade to 4.2.16.Final
|
| Debian:11 | debian | netty | All versions |
| Debian:12 | debian | netty | All versions |
| Debian:13 | debian | netty | All versions |
| Debian:14 | debian | netty | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | netty | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | netty | All versions |
Original advisory text
Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
References
- https://security-tracker.debian.org/tracker/CVE-2026-55851 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-55851 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-55851 Third Party Advisory
- https://github.com/advisories/GHSA-q6cq-mhr2-jmr5
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55851... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55851 Vendor Advisory
- https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5 Vendor Advisory
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final URL
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b Patch
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen21 Jul 2026
Sources
DEBIAN-CVE-2026-55851 · OSV
UBUNTU-CVE-2026-55851 · OSV
CVE-2026-55851 · NVD
CVE-2026-55851 · MITRE
GHSA-q6cq-mhr2-jmr5 · GHSA
CVE-2026-55851 · OSV
Track software like this
Free during beta