Every CVE Search/ Get API key

CVE-2026-50009

Netty QUIC stateless reset token material exposed through header-visible connection IDs

4.8 MediumFix available

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.20%Up 0.2 points since Jun 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

Netty QUIC stateless reset token material exposed through header-visible connection IDs

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

Record
CVE-2026-50009
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-200, CWE-330
Updated
2026-11-02
EUVDEUVD-2026-36462 4.8

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

Record
EUVD-2026-36462
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-cq4q-cv5g-r8q5 4.8

Netty: QUIC stateless reset token material exposed through header-visible connection IDs

Summary

Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet.

Details

The sign-based connection ID generator (HmacSignQuicConnectionIdGenerator) and reset token generator (HmacSignQuicResetTokenGenerator) both evaluate HMAC-SHA256 with the same JVM-wide static key (io.netty.handler.codec.quic.Hmac).

During source CID rotation (QuicheQuicChannel.newSourceConnectionIds), the current server source CID C is used as input to produce the next CID N. The stateless reset token for C is defined over HMAC(K, C), specifically the first 16 bytes. The next CID N is the first L bytes of the same digest, where L = |C|.

Whenever L ≥ 16, the first 16 bytes of N are exactly the stateless reset token for C. Because N is carried in QUIC headers as a connection ID, an observer can read the headers and learn the reset token without decrypting the payload.

This directly violates RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000#name-calculating-a-stateless-res: The stateless reset token MUST be difficult to guess. Additionally https://datatracker.ietf.org/doc/html/rfc9000#name-stateless-reset-oracle

Impact

Information Disclosure and Denial of Service. An on-path attacker can obtain the stateless reset token from the connection ID header and attempt to abruptly close the client side of the connection by sending a spoofed Stateless Reset datagram.

Record
GHSA-cq4q-cv5g-r8q5
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-200, CWE-330
Updated
2026-11-02
NVD 4.8

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

Record
CVE-2026-50009
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-200, CWE-330
Updated
2026-11-02
OSV 4.8

Netty QUIC stateless reset token material exposed through header-visible connection IDs

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

Record
CVE-2026-50009
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-200, CWE-330
Updated
2026-11-02
OSVDEBIAN-CVE-2026-50009 4.8

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

Record
DEBIAN-CVE-2026-50009
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVGHSA-cq4q-cv5g-r8q5 4.8

Netty: QUIC stateless reset token material exposed through header-visible connection IDs

Summary

Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet.

Details

The sign-based connection ID generator (HmacSignQuicConnectionIdGenerator) and reset token generator (HmacSignQuicResetTokenGenerator) both evaluate HMAC-SHA256 with the same JVM-wide static key (io.netty.handler.codec.quic.Hmac).

During source CID rotation (QuicheQuicChannel.newSourceConnectionIds), the current server source CID C is used as input to produce the next CID N. The stateless reset token for C is defined over HMAC(K, C), specifically the first 16 bytes. The next CID N is the first L bytes of the same digest, where L = |C|.

Whenever L ≥ 16, the first 16 bytes of N are exactly the stateless reset token for C. Because N is carried in QUIC headers as a connection ID, an observer can read the headers and learn the reset token without decrypting the payload.

This directly violates RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000#name-calculating-a-stateless-res: The stateless reset token MUST be difficult to guess. Additionally https://datatracker.ietf.org/doc/html/rfc9000#name-stateless-reset-oracle

Impact

Information Disclosure and Denial of Service. An on-path attacker can obtain the stateless reset token from the connection ID header and attempt to abruptly close the client side of the connection by sending a spoofed Stateless Reset datagram.

Record
GHSA-cq4q-cv5g-r8q5
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-200, CWE-330
Updated
2026-11-02
OSVUBUNTU-CVE-2026-50009 4.8

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

Record
UBUNTU-CVE-2026-50009
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
io.netty:netty-codec-classes-quic
Maven
 4.2.0.Final to 4.2.14.Final
4.2.15.Final
netty
Debian:12
 All versions, plus listed versions
1:4.1.48-101:4.1.48-111:4.1.48-121:4.1.48-131:4.1.48-14
Show 7 moreShow less
1:4.1.48-151:4.1.48-161:4.1.48-71:4.1.48-7+deb12u11:4.1.48-7+deb12u21:4.1.48-81:4.1.48-9
 None known
netty
Debian:13
 All versions, plus listed versions
1:4.1.48-101:4.1.48-10+deb13u11:4.1.48-111:4.1.48-121:4.1.48-131:4.1.48-141:4.1.48-151:4.1.48-16
 None known
netty
Debian:14
 All versions, plus listed versions
1:4.1.48-101:4.1.48-111:4.1.48-121:4.1.48-131:4.1.48-141:4.1.48-151:4.1.48-16
 None known
io.netty:netty-codec-classes-quic
Maven
 4.2.0.Final up to 4.2.15.Final, plus listed versions
4.2.1.Final4.2.10.Final4.2.11.Final4.2.12.Final4.2.13.Final
Show 9 moreShow less
4.2.14.Final4.2.2.Final4.2.3.Final4.2.4.Final4.2.5.Final4.2.6.Final4.2.7.Final4.2.8.Final4.2.9.Final
4.2.15.Final
netty
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1:3.2.6.Final-21:3.2.6.Final-2+deb8u2build0.14.04.1~esm11:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
 None known
netty
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1:3.2.6.Final-21:4.0.32-11:4.0.33-11:4.0.34-11:4.0.34-1ubuntu0.1~esm1
Show 4 moreShow less
1:4.0.34-1ubuntu0.1~esm21:4.0.34-1ubuntu0.1~esm31:4.0.34-1ubuntu0.1~esm41:4.0.34-1ubuntu0.1~esm5
 None known
netty
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:4.1.7-41:4.1.7-4ubuntu0.1~esm11:4.1.7-4ubuntu0.11:4.1.7-4ubuntu0.1+esm11:4.1.7-4ubuntu0.1+esm2
Show 5 moreShow less
1:4.1.7-4ubuntu0.1+esm31:4.1.7-4ubuntu0.1+esm41:4.1.7-4ubuntu0.1+esm51:4.1.7-4ubuntu0.1+esm61:4.1.7-4ubuntu0.1+esm7
 None known
netty
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:4.1.33-11:4.1.33-21:4.1.33-31:4.1.45-11:4.1.45-1ubuntu0.1~esm1
Show 5 moreShow less
1:4.1.45-1ubuntu0.1~esm21:4.1.45-1ubuntu0.1~esm31:4.1.45-1ubuntu0.1~esm41:4.1.45-1ubuntu0.1~esm61:4.1.45-1ubuntu0.1~esm7
 None known
netty
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1:4.1.48-41:4.1.48-4+deb11u1build0.22.04.11:4.1.48-4+deb11u2build0.22.04.11:4.1.48-4+deb11u2ubuntu0.1~esm11:4.1.48-4+deb11u2ubuntu0.1~esm2
Show 5 moreShow less
1:4.1.48-4+deb11u2ubuntu0.11:4.1.48-4+deb11u2ubuntu0.1+esm11:4.1.48-4+deb11u2ubuntu0.1+esm31:4.1.48-4+deb11u2ubuntu0.21:4.1.48-4+deb11u2ubuntu0.2+esm1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
netty
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1:4.1.48-71:4.1.48-81:4.1.48-91:4.1.48-9ubuntu0.1~esm11:4.1.48-9ubuntu0.1~esm2
Show 6 moreShow less
1:4.1.48-9ubuntu0.11:4.1.48-9ubuntu0.1+esm11:4.1.48-9ubuntu0.1+esm31:4.1.48-9ubuntu0.21:4.1.48-9ubuntu0.2+esm11:4.1.48-9ubuntu0.2+esm2
 None known
netty
Ubuntu:25.10
 All versions, plus listed versions
1:4.1.48-101:4.1.48-10ubuntu0.25.10.11:4.1.48-10ubuntu0.25.10.2
 None known
netty
Ubuntu:26.10
 All versions, plus listed versions
1:4.1.48-161:4.1.48-16ubuntu1
 None known
netty
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1:4.1.48-101:4.1.48-111:4.1.48-121:4.1.48-131:4.1.48-141:4.1.48-161:4.1.48-16ubuntu0.1~esm2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-50009 is a medium vulnerability (CVSS 4.8) in Netty, published June 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in io.netty:netty-codec-classes-quic 4.2.15.Final.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open