CVE-2022-41881: HAProxyMessageDecoder Stack Exhaustion DoS in io.netty:netty-codec-haproxy
Summary
CVE-2022-41881: HAProxyMessageDecoder Stack Exhaustion DoS. Affects io.netty:netty-codec-haproxy versions < 4.1.86.Final. Fixed in 4.1.86.Final. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2022-41881 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The io.netty:netty-codec-haproxy package is a component of Netty, a popular networking framework for building high-performance, scalable applications. The netty-codec-haproxy module provides support for decoding and encoding HAProxy protocol messages. The HAProxyMessageDecoder class is responsible for parsing these messages. However, a vulnerability has been discovered in the decoder that can lead to a denial-of-service (DoS) condition.
Vulnerability Detail
The vulnerability, identified as CVE-2022-41881, arises from an infinite recursion issue in the HAProxyMessageDecoder. When parsing a malformed crafted message, the decoder can enter an infinite recursion loop, resulting in a StackOverflowError. This error can be triggered by providing a Transport Layer Value (TLV) with a nesting level that exceeds the decoder's capacity. While the StackOverflowError is caught when the decoder is used as part of Netty's ChannelPipeline, using it directly without the ChannelPipeline can cause a thrown exception or crash. The impact of this vulnerability is a DoS condition, potentially disrupting the availability of affected systems.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.86.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround is to use a custom HaProxyMessageDecoder. By implementing a custom decoder, users can mitigate the risk of triggering the infinite recursion and avoid the DoS condition. However, this workaround should only be considered as a temporary solution, and upgrading to the patched version is strongly recommended.
Conclusion
In conclusion, the CVE-2022-41881 vulnerability in the io.netty:netty-codec-haproxy package can lead to a denial-of-service (DoS) condition due to an infinite recursion issue in the HAProxyMessageDecoder. Users are advised to upgrade to version 4.1.86.Final or implement a temporary workaround using a custom decoder. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for io.netty:netty-codec-haproxy →
FAQ
The vulnerability can lead to a denial-of-service (DoS) condition, potentially causing a disruption in the availability of affected systems.
To fix this vulnerability, upgrade to version 4.1.86.Final of the io.netty:netty-codec-haproxy package.
Yes, a temporary workaround is to use a custom HaProxyMessageDecoder to mitigate the risk of triggering the vulnerability.
Yes, the vulnerability can be exploited remotely by sending a crafted message to the affected system.
There is no known public exploitation of this vulnerability at the time of this advisory.
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-codec-haproxy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
