Netty up to 4.1.134.Final/4.2.15.Final codec-haproxy HAProxyMessageDecoder buffer overflow

Summaryinfo

A vulnerability marked as problematic has been reported in Netty up to 4.1.134.Final/4.2.15.Final. This affects the function HAProxyMessageDecoder of the component codec-haproxy. This manipulation causes buffer overflow. This vulnerability is handled as CVE-2026-55851. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Netty up to 4.1.134.Final/4.2.15.Final. It has been declared as problematic. Affected by this vulnerability is the function HAProxyMessageDecoder of the component codec-haproxy. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect availability. The summary by CVE is:

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-55851 since 06/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version 4.1.136.Final or 4.2.16.Final eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Netty

Version

• 4.1.134.Final
• 4.2.15.Final

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion