Vulnerability Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netty | Netty | >= 4.1.0, < 4.1.136 |
Related Weaknesses (CWE)
References
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bPatch
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6Patch
- https://github.com/netty/netty/releases/tag/netty-4.1.136.FinalRelease Notes
- https://github.com/netty/netty/releases/tag/netty-4.2.16.FinalRelease Notes
- https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5Vendor Advisory
FAQ
What is CVE-2026-55851?
CVE-2026-55851 is a vulnerability with a CVSS score of 7.5 (HIGH). Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1....
How severe is CVE-2026-55851?
CVE-2026-55851 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55851?
Check the references section above for vendor advisories and patch information. Affected products include: Netty Netty.