{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/proxy-protocol/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-55851"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-codec-haproxy (\u003e= 4.2.0.Final, \u003c= 4.2.15.Final)","netty-codec-haproxy (\u003e= 4.1.0.Final, \u003c= 4.1.135.Final)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","memory-exhaustion","vulnerability","proxy-protocol"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-55851, has been identified in the \u003ccode\u003eHAProxyMessageDecoder\u003c/code\u003e component within Netty's \u003ccode\u003ecodec-haproxy\u003c/code\u003e module. This flaw allows an unauthenticated attacker to trigger an unbounded memory exhaustion, leading to a denial of service (DoS) for applications utilizing the vulnerable Netty versions. The vulnerability arises from an incorrect interpretation of a signed Java \u003ccode\u003ebyte\u003c/code\u003e during protocol version detection. Specifically, when an attacker sends a PROXY protocol v2 binary prefix (\u003ccode\u003e0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A\u003c/code\u003e) followed by a \u003ccode\u003e0xFF\u003c/code\u003e version byte, the decoder misinterprets the value due to sign extension. This results in a collision with an internal \u0026quot;need more data\u0026quot; sentinel value, trapping the decoder in an infinite loop where it continuously requests more data without processing or discarding previous input. This behavior causes an unbounded accumulation of inbound bytes in the \u003ccode\u003ecumulation\u003c/code\u003e buffer, ultimately exhausting the Java Virtual Machine's (JVM) direct memory allocation and rendering the affected application unresponsive.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker initiates a connection to a vulnerable application using Netty's \u003ccode\u003eHAProxyMessageDecoder\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted PROXY protocol v2 binary header, specifically \u003ccode\u003e0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker then appends a malicious version byte, \u003ccode\u003e0xFF\u003c/code\u003e, immediately following the crafted binary prefix.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eHAProxyMessageDecoder\u003c/code\u003e attempts to perform protocol version detection by reading the 13th byte (the \u003ccode\u003e0xFF\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDue to Java's signed \u003ccode\u003ebyte\u003c/code\u003e type and subsequent widening to \u003ccode\u003eint\u003c/code\u003e without proper masking, the \u003ccode\u003e0xFF\u003c/code\u003e byte is interpreted as \u003ccode\u003eint -1\u003c/code\u003e through sign extension.\u003c/li\u003e\n\u003cli\u003eThis \u003ccode\u003eint -1\u003c/code\u003e value collides with the decoder's internal \u0026quot;need more data\u0026quot; sentinel value, causing the decoder to believe it requires more data to resolve the version.\u003c/li\u003e\n\u003cli\u003eThe decoder enters an infinite loop, continuously requesting more data and never consuming the already received bytes, bypassing size limit enforcements.\u003c/li\u003e\n\u003cli\u003eAll subsequent inbound network traffic is accumulated in an unbounded \u003ccode\u003ecumulation\u003c/code\u003e buffer, leading to the exhaustion of the JVM's direct memory allocation and a denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-55851 leads to a complete denial of service (DoS) for applications using the vulnerable Netty \u003ccode\u003ecodec-haproxy\u003c/code\u003e module. Attackers can trigger unbounded memory exhaustion in the target JVM by sending a specially crafted network payload. This will crash the affected service, making it unavailable to legitimate users. Organizations relying on these Netty versions for critical network services are at risk of service disruption and potential data loss if robust failover mechanisms are not in place. The attack requires no authentication and can be executed remotely, posing a significant threat to internet-facing applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003enetty-codec-haproxy\u003c/code\u003e module to a patched version immediately to remediate CVE-2026-55851. Specifically, upgrade \u003ccode\u003emaven/io.netty:netty-codec-haproxy\u003c/code\u003e to \u003ccode\u003e4.2.16.Final\u003c/code\u003e or later, or \u003ccode\u003e4.1.136.Final\u003c/code\u003e or later.\u003c/li\u003e\n\u003cli\u003eImplement network intrusion detection/prevention systems (NIDS/NIPS) to monitor for unusual PROXY protocol traffic patterns that could indicate attempted exploitation of CVE-2026-55851.\u003c/li\u003e\n\u003cli\u003eEnsure robust application monitoring is in place to detect sudden increases in direct memory usage or JVM crashes that could be indicative of an attack exploiting CVE-2026-55851.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T21:24:38Z","date_published":"2026-07-22T21:24:38Z","id":"https://feed.craftedsignal.io/briefs/2026-07-netty-haproxymessagedecoder-mem-exhaust/","summary":"A vulnerability, CVE-2026-55851, in Netty's `HAProxyMessageDecoder` can lead to unbounded memory exhaustion when an attacker sends a specific PROXY protocol v2 binary prefix followed by a version byte of `0xFF`, causing a signed-byte sentinel collision that traps the decoder in a version-detection loop and ultimately exhausts the JVM's direct memory allocation, resulting in a denial of service.","title":"Netty HAProxyMessageDecoder Vulnerability Leads to Unbounded Memory Exhaustion","url":"https://feed.craftedsignal.io/briefs/2026-07-netty-haproxymessagedecoder-mem-exhaust/"}],"language":"en","title":"CraftedSignal Threat Feed - Proxy-Protocol","version":"https://jsonfeed.org/version/1.1"}