Skip to content
Threat Feed
Subscribe

Product

Netty-Codec-Haproxy (>= 4.2.0.Final, <= 4.2.15.Final)

1 brief RSS
medium advisory

Netty HAProxyMessageDecoder Vulnerability Leads to Unbounded Memory Exhaustion

A vulnerability, CVE-2026-55851, in Netty's `HAProxyMessageDecoder` can lead to unbounded memory exhaustion when an attacker sends a specific PROXY protocol v2 binary prefix followed by a version byte of `0xFF`, causing a signed-byte sentinel collision that traps the decoder in a version-detection loop and ultimately exhausts the JVM's direct memory allocation, resulting in a denial of service.

netty-codec-haproxy +1 denial-of-service memory-exhaustion vulnerability proxy-protocol
1c