Unbounded memory exhaustion in Netty HAProxyMessageDecoder (CVE-2026-55851)

A signed-byte sentinel collision in Netty's `HAProxyMessageDecoder` (`codec-haproxy` module) causes the decoder to enter a perpetual version-detection loop when a PROXY protocol v2 stream contains version byte `0xFF`. The sign-extended value `-1` collides with the decoder's need-more-data sentinel, preventing byte consumption and causing `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded buffer until direct memory is exhausted. Affected versions: - >= 4.2.0.Final, <= 4.2.15.Final - >= 4.1.0.Final, <= 4.1.135.Final We recommend updating to: 4.2.16.Final, 4.1.136.Final. CVSS 8.7 · our assessment: this_week Reference: https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5 Details: https://vuln.today/cve/CVE-2026-55851