CVE-2026-55851: Netty HAProxyMessageDecoder DoS Vulnerability

CVE-2026-55851 Overview

CVE-2026-55851 is a denial-of-service vulnerability in Netty, a widely used Java network application framework for protocol servers and clients. The flaw resides in the HAProxyMessageDecoder within the codec-haproxy module. The decoder performs PROXY protocol version detection by reading the 13th byte as a signed Java byte and widening it to int without masking. A crafted PROXY v2 binary prefix followed by version byte 0xFF sign-extends to -1, which collides with the decoder's need-more-data sentinel. This causes ByteToMessageDecoder to accumulate inbound bytes in an unbounded cumulation buffer until direct memory is exhausted. Affected versions include 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.136. The issue maps to [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated remote attackers can trigger direct memory exhaustion on Netty-based services accepting HAProxy PROXY protocol traffic, leading to service outage.

Affected Products

Netty codec-haproxy versions 4.2.0.Final through 4.2.15.Final
Netty codec-haproxy versions 4.1.0.Final through 4.1.135
Applications embedding Netty and configuring HAProxyMessageDecoder in the pipeline

Discovery Timeline

2026-07-21 - CVE-2026-55851 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-55851

Vulnerability Analysis

The HAProxy PROXY protocol v2 uses a 12-byte binary signature followed by a version and command byte at offset 12. Netty's HAProxyMessageDecoder reads this 13th byte to determine the protocol version. The decoder stores the value into an int after widening from a signed Java byte without applying a & 0xFF mask.

When an attacker sends the valid 12-byte PROXY v2 prefix followed by 0xFF, sign extension converts the byte to -1. The decoder's internal control flow uses -1 as a need-more-data sentinel. The decoder therefore signals that more input is required and refuses to consume the buffered bytes.

ByteToMessageDecoder responds by continuing to accumulate inbound data into its cumulation buffer. Because no forward progress is possible, the buffer grows without bound until the JVM's direct memory pool is exhausted, causing an OutOfDirectMemoryError and service disruption.

Root Cause

The root cause is a sign extension error [CWE-681 / CWE-400]. Java's byte type is signed, so promoting a byte value greater than 0x7F to int yields a negative number unless explicitly masked. The version detection logic treated the widened value as an unsigned protocol version but shared its numeric space with an internal sentinel used to request additional bytes, producing an infinite accumulation loop.

Attack Vector

Exploitation requires only network access to a port where a Netty-based service has installed HAProxyMessageDecoder. No authentication or user interaction is needed. An attacker opens a TCP connection, sends the PROXY v2 signature 0x0D 0x0A 0x0D 0x0A 0x00 0x0D 0x0A 0x51 0x55 0x49 0x54 0x0A followed by version byte 0xFF, and then streams arbitrary bytes. Each additional byte enlarges the cumulation buffer until direct memory is exhausted.

Because realCodeExamples for this specific decoder path were not provided, refer to the upstream fix commits and the advisory for the corrected parsing logic. See Netty commit 5b68c61, Netty commit bb2ff68, and GHSA-q6cq-mhr2-jmr5.

Detection Methods for CVE-2026-55851

Indicators of Compromise

Inbound TCP payloads beginning with the PROXY v2 signature 0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A followed by version byte 0xFF.
JVM logs containing io.netty.util.internal.OutOfDirectMemoryError or Direct buffer memory exceptions on services using codec-haproxy.
Sustained growth of PooledByteBufAllocator direct memory metrics without a corresponding rise in successful requests.

Detection Strategies

Inspect network traffic to Netty-fronted endpoints for PROXY v2 prefixes whose 13th byte is outside the expected 0x2X version/command range.
Correlate connection-level byte counters with application-level message counters to identify sessions that ingest data without producing decoded frames.
Use dependency scanning to enumerate applications shipping netty-codec-haproxy at vulnerable versions.

Monitoring Recommendations

Track JVM direct memory usage and alert on rapid, sustained increases.
Monitor connection duration, ingress byte volume, and decoded message ratios per client IP for anomalies.
Enable Netty leak detection and forward ResourceLeakDetector logs to a centralized log platform for review.

How to Mitigate CVE-2026-55851

Immediate Actions Required

Upgrade Netty to 4.1.136.Final or 4.2.16.Final in all applications that include the codec-haproxy module.
Audit transitive dependencies with mvn dependency:tree or gradle dependencies to locate vulnerable Netty versions.
Restrict exposure of ports terminating the PROXY protocol so that only trusted load balancers can reach them.

Patch Information

The issue is fixed in Netty 4.1.136.Final and 4.2.16.Final. Details are published in the GitHub Security Advisory GHSA-q6cq-mhr2-jmr5, with corrective changes in commit 5b68c61 and commit bb2ff68.

Workarounds

Cap ByteToMessageDecoder cumulation size by placing a length-bounded frame decoder or read-timeout handler ahead of HAProxyMessageDecoder in the pipeline.
Enforce a maximum idle timeout using IdleStateHandler so connections that never produce a decoded frame are closed.
Front the service with a load balancer that generates well-formed PROXY protocol headers and reject direct client connections at the network layer.

bash

# Maven dependency override to force patched Netty
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.1.136.Final
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.2.16.Final

# Verify no vulnerable versions remain
mvn dependency:tree | grep -E "netty-codec-haproxy:(4\.1\.[0-9]+|4\.2\.[0-9]+)"