Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-55851 Netty is a network application framework for development of protocol servers and clients. In versions http://4.2.0.Final up to (but not including) http://4.2.16.Final, and http://4.1.0.Fi… https://www.cve.org/CVERecord?id=CVE-2026-55851
Post summary
The snippet identifies CVE-2026-55851 as affecting certain Netty versions and links to the CVE record, but provides no further technical or exploit details.
🚨*CVE* CVE-2026-55851 Netty is a network application framework for development of protocol servers and clients. In versions http://4.2.0.Final up to (but not including) http://4.2.16.Final, and http://4.1.0.Fi… … http://infoflow.cloud`
Post summary
The text only announces CVE‑2026‑55851 with a range of affected Netty versions, lacking any actionable details or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | netty | netty | - | - | - |