CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by reading the 13th byte as a signed Java byte and widening it to int without masking; a PROXY protocol v2 binary prefix followed by version byte 0xFF sign-extends to -1, collides with the decoder's need-more-data sentinel, and causes ByteToMessageDecoder to accumulate inbound bytes in an unbounded cumulation buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

The HAProxyMessageDecoder in netty's codec-haproxy module performs protocol version detection by reading the 13th byte of the inbound stream as a signed Java byte and widening it to int without masking. When an attacker sends a PROXY protocol v2 binary prefix (0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A) followed by version byte 0xFF, the sign extension produces -1, which collides with the decoder's "need more data" sentinel value. This collision traps the decoder in a version-detection loop where it perpetually requests more data without consuming any bytes, never instantiates the HeaderExtractor that enforces header size limits, and causes ByteToMessageDecoder to accumulate all subsequent inbound bytes into an unbounded cumulation buffer until the JVM exhausts its direct memory allocation.

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-haproxy 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-44893, CVE-2026-48059, CVE-2026-55851, and CVE-2026-59919.

CVE-2026-44893: Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

CVE-2026-48059: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

CVE-2026-55851: Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

CVE-2026-59919: Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

This patched artifact is a drop-in replacement for io.netty:netty-codec-haproxy 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by reading the 13th byte as a signed Java byte and widening it to int without masking; a PROXY protocol v2 binary prefix followed by version byte 0xFF sign-extends to -1, collides with the decoder's need-more-data sentinel, and causes ByteToMessageDecoder to accumulate inbound bytes in an unbounded cumulation buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.135.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.130.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 14 CVEs. Fixed in 4.1.115.Final-tuxcare.8.

TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4.

These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues:

Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.

Security issues fixed

• CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp (bsc#1271435).
• CVE-2026-55831: resource exhaustion/DoS in io.netty:netty-codec-http (bsc#1271960).
• CVE-2026-55833: zip bomb in io.netty:netty-codec-http (bsc#1271961).
• CVE-2026-55851: memory exhaustion in io.netty:netty-codec-haproxy (bsc#1272253).
• CVE-2026-56745: memory exhaustion in io.netty:netty-codec-http (bsc#1272254).
• CVE-2026-56746: improper access control in io.netty:netty-codec-http (CORS) (bsc#1272255).
• CVE-2026-56817: insecure defaults in XML parsing in io.netty:netty-codec-xml (bsc#1272257).
• CVE-2026-56818: memory leak in io.netty:netty-codec-redis (bsc#1272603).
• CVE-2026-56819: memory leak in io.netty:netty-codec-http2 (bsc#1272258).
• CVE-2026-56820: improper certificate validation in io.netty:netty-handler-ssl-ocsp (bsc#1272259).
• CVE-2026-56821: improper certificate revocation check in io.netty:netty-handler-ssl-ocsp (bsc#1272299).
• CVE-2026-56822: time-of-check/time-of-use in io.netty:netty-handler-ssl-ocsp (bsc#1272300).
• CVE-2026-59898: protocol version confusion in io.netty:netty-codec-http (websocket) (bsc#1272302).
• CVE-2026-59899: memory exhaustion in io.netty:netty-codec-http (bsc#1272301).
• CVE-2026-59900: improper header neutralization in io.netty:netty-codec-http2 (bsc#1272303).
• CVE-2026-59901: infinite loop in io.netty:netty-codec-compression (bzip2) (bsc#1272304).
• CVE-2026-59919: improper CR/LF neutralization in io.netty:netty-codec-haproxy (bsc#1272305).
• CVE-2026-59920: improper CR/LF neutrolization in io.netty:netty-codec-stomp (bsc#1272306).
• CVE-2026-59921: improper CR/LF neutralization in io.netty:netty-codec-http (multipart) (bsc#1272307).
• Memory leak in io.netty:netty-codec-dns (bsc#1272519).
• Uncontrolled resource consumption in io.netty:netty-codec-xml (bsc#1272518).

Other updates and bugfixes:

• Upgrade to upstream version 4.1.136:
  • SingleThreadEventExecutor: document Throwable safety contract on run()
  • Make HTTP/2 frame hashCode consistent with equals
  • Add BlockHound exception for DnsQueryIdSpace (#16896)
  • FlowControlHandler: Fix autoRead behavior
  • Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize
  • MQTT: Fix MQTT decoder size check after variable header replay
  • MQTT: Make the decodeProperties early-REPLAY check actually fire
  • Reject control characters at the boundary of HTTP method names (#16723)
  • Update to latest tcnative release
  • Fix HTTP 2 PUSH_PROMISE stream association validation
  • Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder
  • Add opt-in validation of mandatory pseudo-header fields for HTTP/2
  • Strictly validate MQTT UTF-8 Encoded String (#16939)
  • Stop DateFormatter trailing token from running past the parse end
  • IpFilter: Deprecate constructor which use accept by default
  • Add RFC 10008 QUERY Method support (#16966)
  • Correctly release and fail queued traffic-shaping writes on close (#16959)
  • FlowControlHandler: respect auto-read when toggled while dequeueing
  • IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982)
  • Fix typo in AbstractSniHandler Javadoc
  • Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames
  • Reject control characters at the boundary of the HTTP version token (#16971)
  • Reset UTF-8 decode state on CR in StompSubframeDecoder
  • HTTP2: Pass the correct number of arguments when logging goaway
  • FastLz: Guard decompression against truncated input (#17000)
  • Fix propagation of startTls for client SslContext handler
  • Reject non-token characters in HTTP/2 header names +…