{"id":"CVE-2026-55851","title":"io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851)","summary":"A flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770","CWE-400"],"vendor":"Red Hat","product":"OpenShift Serverless","affected":["openshift_serverless","build_of_apache_camel_hawtio 4","build_of_apache_camel_4_for_quarkus 3","build_of_apicurio_registry 3","build_of_debezium 3","build_of_keycloak","jboss_enterprise_application_platform 7","openshift_dev_spaces","single_sign_on 7","streams_for_apache_kafka 2","streams_for_apache_kafka 3","cryostat_4_on_rhel 9","amq_broker 7.14.1","build_of_apache_camel_4_18_for_quarkus 3.33","data_grid 8.6.3","openshift_ai 2.25","build_of_apache_camel_4_18_3_for_spring_boot 3.5.16","build_of_quarkus 3.27.4.SP3","build_of_quarkus 3.33.2.SP3"],"patched":["cryostat_4_on_rhel 9","amq_broker 7.14.1","build_of_apache_camel_4_18_for_quarkus 3.33","data_grid 8.6.3","openshift_ai 2.25","build_of_apache_camel_4_18_3_for_spring_boot 3.5.16","build_of_quarkus 3.27.4.SP3","build_of_quarkus 3.33.2.SP3"],"published":"2026-07-21","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:19:48+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55851.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55851.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-55851"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2505698"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55851"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55851"},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"},{"url":"https://access.redhat.com/errata/RHSA-2026:68333"},{"url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"url":"https://access.redhat.com/errata/RHSA-2026:48118"},{"url":"https://access.redhat.com/errata/RHSA-2026:69296"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:54622"},{"url":"https://access.redhat.com/errata/RHSA-2026:47189"},{"url":"https://access.redhat.com/errata/RHSA-2026:47172"},{"url":"https://github.com/advisories/GHSA-q6cq-mhr2-jmr5"}],"tags":["csaf","vex","red-hat","ghsa","maven"],"epss":0.00612,"epssPercentile":0.47654,"aliases":["GHSA-q6cq-mhr2-jmr5"],"ecosystem":"maven","ingestedAt":"2026-07-22T22:06:58.003Z","slug":"CVE-2026-55851","body":"## Overview\n\nA flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion.\n\n## Vendor advisories\n\n- **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333)\n- **RHSA-2026:66488** · Red Hat · fixed in: Red Hat AMQ Broker 7.14.1 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66488)\n- **RHSA-2026:48118** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48118)\n- **RHSA-2026:69296** · Red Hat · fixed in: Red Hat Data Grid 8.6.3 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69296)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:54622** · Red Hat · fixed in: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54622)\n- **RHSA-2026:47189** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.4.SP3 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:47189)\n- **RHSA-2026:47172** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.2.SP3 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:47172)\n- **Red Hat VEX** · Important · affected: OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, … · no fix planned: Red Hat build of Debezium 3, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7, OpenShift Serverless, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55851.json)\n\n**io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message** — rated Important by Red Hat. Released 2026-07-21, updated 2026-09-21.\n\nAffected:\n\n- OpenShift Serverless\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat Build of Keycloak\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n- streams for Apache Kafka 3\n\nFixed:\n\n- Cryostat 4 on RHEL 9\n- Red Hat AMQ Broker 7.14.1\n- Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\n- Red Hat Data Grid 8.6.3\n- Red Hat OpenShift AI 2.25\n- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16\n- Red Hat build of Quarkus 3.27.4.SP3\n- Red Hat build of Quarkus 3.33.2.SP3\n\nNo fix planned:\n\n- Red Hat build of Debezium 3\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat Single Sign-On 7\n- OpenShift Serverless\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Keycloak\n- Red Hat OpenShift Dev Spaces\n- streams for Apache Kafka 2\n- streams for Apache Kafka 3\n\nNot affected:\n\n- Cryostat 4 on RHEL 9\n- Red Hat OpenShift AI 2.25\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat Satellite 6\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333\nBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2026:66488\nBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2026:48118\n\n## Package advisory (CVE-2026-55851)\n\nAffected packages:\n\n- `io.netty:netty-codec-haproxy >= 4.2.0.Final, <= 4.2.15.Final`\n- `io.netty:netty-codec-haproxy >= 4.1.0.Final, <= 4.1.135.Final`\n\nPatched in:\n\n- `io.netty:netty-codec-haproxy 4.2.16.Final`\n- `io.netty:netty-codec-haproxy 4.1.136.Final`\n\nSource: https://github.com/advisories/GHSA-q6cq-mhr2-jmr5","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201786,"id":"CVE-2026-55851","ts":1789399724159,"field":"cvss","old":null,"new":"7.5"},{"seq":200516,"id":"CVE-2026-55851","ts":1789397372197,"field":"cvss","old":"7.5","new":null},{"seq":198433,"id":"CVE-2026-55851","ts":1789391953293,"field":"cvss","old":null,"new":"7.5"},{"seq":196226,"id":"CVE-2026-55851","ts":1789383583691,"field":"cvss","old":"7.5","new":null},{"seq":195155,"id":"CVE-2026-55851","ts":1789380473422,"field":"cvss","old":null,"new":"7.5"},{"seq":193942,"id":"CVE-2026-55851","ts":1789378512635,"field":"cvss","old":"7.5","new":null},{"seq":192729,"id":"CVE-2026-55851","ts":1789376405267,"field":"cvss","old":null,"new":"7.5"},{"seq":191516,"id":"CVE-2026-55851","ts":1789373418148,"field":"cvss","old":"7.5","new":null},{"seq":190301,"id":"CVE-2026-55851","ts":1789369296309,"field":"cvss","old":null,"new":"7.5"},{"seq":189088,"id":"CVE-2026-55851","ts":1789368265434,"field":"cvss","old":"7.5","new":null},{"seq":187871,"id":"CVE-2026-55851","ts":1789365141274,"field":"cvss","old":null,"new":"7.5"},{"seq":186658,"id":"CVE-2026-55851","ts":1789363269674,"field":"cvss","old":"7.5","new":null},{"seq":185444,"id":"CVE-2026-55851","ts":1789361096677,"field":"cvss","old":null,"new":"7.5"},{"seq":184231,"id":"CVE-2026-55851","ts":1789358154118,"field":"cvss","old":"7.5","new":null},{"seq":182482,"id":"CVE-2026-55851","ts":1789354215518,"field":"cvss","old":null,"new":"7.5"},{"seq":181275,"id":"CVE-2026-55851","ts":1789353118969,"field":"cvss","old":"7.5","new":null},{"seq":180068,"id":"CVE-2026-55851","ts":1789350160559,"field":"cvss","old":null,"new":"7.5"},{"seq":178861,"id":"CVE-2026-55851","ts":1789348099564,"field":"cvss","old":"7.5","new":null},{"seq":177654,"id":"CVE-2026-55851","ts":1789346271101,"field":"cvss","old":null,"new":"7.5"},{"seq":176447,"id":"CVE-2026-55851","ts":1789343017227,"field":"cvss","old":"7.5","new":null},{"seq":174564,"id":"CVE-2026-55851","ts":1789334759881,"field":"cvss","old":null,"new":"7.5"},{"seq":173359,"id":"CVE-2026-55851","ts":1789333484253,"field":"cvss","old":"7.5","new":null},{"seq":172173,"id":"CVE-2026-55851","ts":1789331008808,"field":"cvss","old":null,"new":"7.5"},{"seq":170987,"id":"CVE-2026-55851","ts":1789328612914,"field":"cvss","old":"7.5","new":null},{"seq":169782,"id":"CVE-2026-55851","ts":1789327044747,"field":"cvss","old":null,"new":"7.5"},{"seq":168577,"id":"CVE-2026-55851","ts":1789323658146,"field":"cvss","old":"7.5","new":null},{"seq":167372,"id":"CVE-2026-55851","ts":1789319576195,"field":"cvss","old":null,"new":"7.5"},{"seq":166167,"id":"CVE-2026-55851","ts":1789318558852,"field":"cvss","old":"7.5","new":null},{"seq":164962,"id":"CVE-2026-55851","ts":1789315695738,"field":"cvss","old":null,"new":"7.5"},{"seq":163757,"id":"CVE-2026-55851","ts":1789313450266,"field":"cvss","old":"7.5","new":null},{"seq":162552,"id":"CVE-2026-55851","ts":1789311810731,"field":"cvss","old":null,"new":"7.5"},{"seq":161347,"id":"CVE-2026-55851","ts":1789308523046,"field":"cvss","old":"7.5","new":null},{"seq":160852,"id":"CVE-2026-55851","ts":1789304472836,"field":"cvss","old":null,"new":"7.5"},{"seq":160399,"id":"CVE-2026-55851","ts":1789303981609,"field":"cvss","old":"7.5","new":null},{"seq":159460,"id":"CVE-2026-55851","ts":1789300399623,"field":"cvss","old":null,"new":"7.5"},{"seq":158690,"id":"CVE-2026-55851","ts":1789299493635,"field":"cvss","old":"7.5","new":null},{"seq":157654,"id":"CVE-2026-55851","ts":1789296578829,"field":"cvss","old":null,"new":"7.5"},{"seq":156449,"id":"CVE-2026-55851","ts":1789294594589,"field":"cvss","old":"7.5","new":null},{"seq":155244,"id":"CVE-2026-55851","ts":1789292784554,"field":"cvss","old":null,"new":"7.5"},{"seq":154039,"id":"CVE-2026-55851","ts":1789289589030,"field":"cvss","old":"7.5","new":null},{"seq":152689,"id":"CVE-2026-55851","ts":1789281487608,"field":"cvss","old":null,"new":"7.5"},{"seq":152329,"id":"CVE-2026-55851","ts":1789281098124,"field":"cvss","old":"7.5","new":null},{"seq":151290,"id":"CVE-2026-55851","ts":1789277533497,"field":"cvss","old":null,"new":"7.5"},{"seq":150251,"id":"CVE-2026-55851","ts":1789276078890,"field":"cvss","old":"7.5","new":null},{"seq":149218,"id":"CVE-2026-55851","ts":1789273730089,"field":"cvss","old":null,"new":"7.5"},{"seq":148185,"id":"CVE-2026-55851","ts":1789271120250,"field":"cvss","old":"7.5","new":null},{"seq":146220,"id":"CVE-2026-55851","ts":1789269275616,"field":"cvss","old":null,"new":"7.5"},{"seq":142832,"id":"CVE-2026-55851","ts":1789261354960,"field":"cvss","old":"7.5","new":null},{"seq":141663,"id":"CVE-2026-55851","ts":1789258739159,"field":"cvss","old":null,"new":"7.5"},{"seq":140504,"id":"CVE-2026-55851","ts":1789256579457,"field":"cvss","old":"7.5","new":null}]}