Netty EUVD-2026-46438

The target application must use Netty's codec-haproxy module with HAProxyMessageDecoder in its channel pipeline and accept PROXY protocol v2 traffic from the attacker's network position - this is the concrete prerequisite. Exploitation is unauthenticated (PR:N) and needs no user interaction, but the specific trigger is a PROXY protocol v2 binary prefix followed by version byte 0xFF, which sign-extends to -1 and collides with the need-more-data sentinel. The main limiting factor is configuration: applications that do not include the HAProxy decoder in their pipeline are not reachable, so real exposure depends on whether the service terminates PROXY protocol directly on an untrusted-facing listener rather than behind a trusted load balancer.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes a network-reachable, low-complexity, unauthenticated attack whose only impact is availability, consistent with a resource-exhaustion DoS rather than code execution or data disclosure. The 8.7 score is entirely availability-driven; there is no confidentiality or integrity loss. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is identified, so this is best treated as a credible but not confirmed-exploited DoS. The key limiting factor not captured by raw CVSS is deployment-specific: the vulnerable code path executes only when an application actually places HAProxyMessageDecoder in its Netty pipeline (i.e., it accepts or terminates PROXY protocol traffic). For such deployments the bug is trivial to trigger; for the majority of Netty applications that do not use codec-haproxy, the vulnerability is not reachable. Net assessment: high priority for PROXY-protocol-enabled services, low practical risk elsewhere.

An attacker connects over the network to a Netty-based service that accepts the HAProxy PROXY protocol and sends a PROXY v2 binary prefix whose version byte is 0xFF. The decoder treats the byte as -1, never completes parsing, and buffers all further bytes the attacker streams; by keeping the connection open and continuing to send data the attacker drives direct memory to exhaustion and crashes or stalls the service. No authentication or user interaction is required, and no public exploit is identified at time of analysis.