CyberRota Analysis
AI-GeneratedThe vulnerability affects the `HAProxyMessageDecoder` in specific versions of Netty, where improper handling of the PROXY protocol v2 binary prefix can lead to unbounded memory accumulation, potentially exhausting direct memory resources. This can result in denial-of-service conditions, impacting applications relying on the affected Netty versions for network communication. Organizations using these versions should prioritize updating to at least 4.1.136.Final or 4.2.16.Final to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Related CVEs
Other vulnerabilities affecting the same vendor(s)