CVE-2026-55851 netty CVE debrief

Who should care

Users of Netty versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135 should be aware of this vulnerability and take steps to mitigate it. This includes updating to a patched version of Netty, specifically 4.1.136.Final or 4.2.16.Final, and ensuring that their systems are not exposed to untrusted input.

Technical summary

The HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by reading the 13th byte as a signed Java byte and widening it to int without masking. A PROXY protocol v2 binary prefix followed by version byte 0xFF sign-extends to -1, colliding with the decoder's need-more-data sentinel. This causes ByteToMessageDecoder to accumulate inbound bytes in an unbounded cumulation buffer until direct memory is exhausted. Users should review vendor guidance and update to a patched version.

Defensive priority

High, as the vulnerability can lead to denial-of-service attacks by exhausting direct memory through an unbounded cumulation buffer. Users should prioritize updating to a patched version and review compensating controls for exposed systems while remediation is scheduled and verified. Monitor for unusual traffic patterns and implement compensating controls to limit potential damage. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory and source tracking are also recommended to ensure thorough mitigation and verification of remediation efforts across the environment. Rollback change windows if necessary to ensure system integrity. These actions help ensure that systems are protected against potential exploitation and that any exposure is properly managed and verified as remediated. Therefore, a high defensive priority is warranted to address the potential impact of this vulnerability on system availability and security. The defensive priority level reflects the urgency and potential impact of the vulnerability, guiding defenders in allocating resources effectively to mitigate the risk. By prioritizing defensive actions based on this classification, defenders can ensure that the most critical vulnerabilities are addressed promptly and efficiently, minimizing potential damage and ensuring the security and availability of affected systems. This approach enables defenders to manage vulnerabilities proactively and maintain the integrity of their systems and data. In line with best practices for vulnerability management, defenders should consider the potential impact of this vulnerability on their specific environment and adjust their defensive priorities accordingly to ensure effective risk mitigation

Recommended defensive actions

• Update to Netty version 4.1.136.Final or 4.2.16.Final
• Ensure systems are not exposed to untrusted input
• Monitor for unusual traffic patterns
• Implement compensating controls to limit potential damage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-21T22:17:14.340Z and has been modified since then. The NVD entry is currently Awaiting Analysis. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. Evidence is limited, and defenders should verify system exposure and review vendor guidance for affected Netty versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135.

Official resources