The HAProxyMessageDecoder in netty's codec-haproxy module reads the 13th byte of an inbound stream as a signed Java byte and widens it to an int without masking. When an attacker sends a PROXY protocol v2 prefix followed by a version byte of 0xFF, the sign extension produces -1, colliding with the decoder's sentinel value indicating 'need more data'. This causes the decoder to enter a version-detection loop, perpetually requesting more data without consuming bytes, preventing instantiation of the HeaderExtractor that enforces header size limits. Consequently, the ByteToMessageDecoder accumulates all subsequent inbound bytes into an unbounded buffer, leading to JVM direct memory exhaustion.

This vulnerability allows an unauthenticated attacker to cause a denial of service by exhausting the JVM's direct memory allocation through unbounded buffer growth. The decoder's infinite loop prevents normal processing of inbound data, potentially disrupting services relying on netty's codec-haproxy module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections to detect and block malicious PROXY protocol v2 messages with invalid version bytes. Avoid processing untrusted input with vulnerable versions of the codec-haproxy module.