Netty’s HAProxyMessageDecoder misinterprets the 13th byte of a HAProxy v2 protocol header when the version byte is 0xFF. Because the byte is promoted to an int without masking, the resulting negative value matches the decoder’s sentinel for “need more data.” The decoder then continues to concatenate incoming bytes into an unbounded cumulation buffer, eventually exhausting the JVM’s direct memory and crashing the application or causing a service outage.

The vulnerability affects the Netty network framework, specifically the codec‑haproxy module. Versions 4.1.0.Final through 4.1.134 (inclusive) and 4.2.0.Final through 4.2.15 (inclusive) are impacted. The issue is resolved in Netty 4.1.136.Final and 4.2.16.Final, as well as later releases.

The CVSS score of 8.7 indicates a high severity impact. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not yet listed in the CISA KEV catalog. However, any host that accepts HAProxy protocol traffic can be targeted by sending a specially crafted HAProxy v2 header with a version byte of 0xFF, triggering the unchecked buffer growth and leading to an unbounded memory allocation. This path requires network access to the application and can be used to force a denial of service by exhausting available memory resources.