PT-2026-62225 · Netty · Netty

CVE-2026-55851 · Published 2026-07-21 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.134 Netty versions 4.2.0.Final through 4.2.15

Description The HAProxyMessageDecoder in the codec-haproxy module performs protocol version detection by reading the 13th byte as a signed Java byte and widening it to int without masking. A PROXY protocol v2 binary prefix followed by version byte 0xFF sign-extends to -1, which collides with the decoder's need-more-data sentinel. This causes the ByteToMessageDecoder to accumulate inbound bytes in an unbounded cumulation buffer until direct memory is exhausted.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-55851

GHSA-Q6CQ-MHR2-JMR5

Affected Products

Netty

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55851.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-55851 · Security Note
• https://osv.dev/vulnerability/CVE-2026-55851 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q6cq-mhr2-jmr5 · Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5 · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b · Note
• https://github.com/netty/netty · Note