CVE-2026-50560

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called SETTINGS_MAX_HEADER_LIST_SIZE. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Summary

Netty HTTP/2 max header size handling produces attack similar to HTTP/2 Rapid Reset.

Details

There is a setting in the http2 specification called SETTINGS_MAX_HEADER_LIST_SIZE. According to the RFC: “This advisory setting informs a peer of the maximum field section size that the sender is prepared to accept, in units of octets.”

When a client sends that setting to Netty, it appears that Netty will behave as follows:

• Read the request
• Proxy the request to the origin
• Attempt to produce a response
• Create an exception while writing the headers for the response

Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature.

Remediation

When speaking with clients, Netty should potentially treat this as “advisory” and ignore it. It would be best to ignore the SETTINGS_MAX_HEADER_LIST_SIZE setting from clients (or ignore it when sending to clients). According to the spec, a server does not need to honor this advisory setting, and it appears that other http/2 implementations ignore it when acting as a server.

Impact

This is a DDoS attack similar to the HTTP/2 Rapid Reset Attack.

Credit

Jonathan Looney (Engineering, Netflix)

Contact

Ashley Tolbert (Security, Netflix) - [email protected]

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-http2 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-55163, CVE-2026-33871, CVE-2026-42587, CVE-2026-47244, CVE-2026-48043, CVE-2026-50560, CVE-2026-56819, and CVE-2026-59900.

CVE-2025-55163: Netty MadeYouReset HTTP/2 DDoS Vulnerability

CVE-2026-33871: Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

CVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

CVE-2026-47244: Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

CVE-2026-48043: netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

CVE-2026-56819: Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

CVE-2026-59900: Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

This patched artifact is a drop-in replacement for io.netty:netty-codec-http2 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called SETTINGS_MAX_HEADER_LIST_SIZE. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

TuxCare rebuilt 4 io.netty packages to address 5 CVEs. Fixed in 4.1.93.Final-tuxcare.2.

TuxCare rebuilt 5 io.netty packages to address 5 CVEs. Fixed in 4.1.92.Final-tuxcare.4.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.82.Final-tuxcare.3.

TuxCare rebuilt 4 io.netty packages to address 5 CVEs. Fixed in 4.1.117.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 11 CVEs. Fixed in 4.1.130.Final-tuxcare.1.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.75.Final-tuxcare.3.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.73.Final-tuxcare.2.

TuxCare rebuilt 8 io.netty packages to address 13 CVEs. Fixed in 4.1.115.Final-tuxcare.7.

TuxCare rebuilt 2 io.netty packages to address 3 CVEs. Fixed in 4.1.63.Final-tuxcare.4.

TuxCare rebuilt 9 io.netty packages to address 14 CVEs. Fixed in 4.1.112.Final-tuxcare.5.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 4 io.netty packages to address 4 CVEs. Fixed in 4.1.48.Final-tuxcare.2.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.49.Final-tuxcare.3.

TuxCare rebuilt 7 io.netty packages to address 8 CVEs. Fixed in 4.1.79.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 11 CVEs. Fixed in 4.1.52.Final-tuxcare.3.

TuxCare rebuilt 11 io.netty packages to address 18 CVEs. Fixed in 4.1.87.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 19 CVEs. Fixed in 4.1.99.Final-tuxcare.1.

TuxCare rebuilt 46 io.netty packages to address 19 CVEs. Fixed in 4.1.80.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 15 CVEs. Fixed in 4.1.101.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 19 CVEs. Fixed in 4.1.96.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 13 CVEs. Fixed in 4.1.100.Final-tuxcare.1.

TuxCare rebuilt 8 io.netty packages to address 17 CVEs. Fixed in 4.1.128.Final-tuxcare.1.

TuxCare rebuilt 15 io.netty packages to address 27 CVEs. Fixed in 4.1.72.Final-tuxcare.1.

TuxCare rebuilt 43 io.netty packages to address 25 CVEs. Fixed in 4.1.68.Final-tuxcare.1.

TuxCare rebuilt 14 io.netty packages to address 26 CVEs. Fixed in 4.1.118.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.114.Final-tuxcare.1.

TuxCare rebuilt 10 io.netty packages to address 15 CVEs. Fixed in 4.1.113.Final-tuxcare.1.

TuxCare rebuilt 40 io.netty packages to address 26 CVEs. Fixed in 4.1.53.Final-tuxcare.1.

TuxCare rebuilt 11 io.netty packages to address 21 CVEs. Fixed in 4.1.51.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.74.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 11 CVEs. Fixed in 4.1.24.Final-tuxcare.2.

TuxCare rebuilt 36 io.netty packages to address 12 CVEs. Fixed in 4.1.29.Final-tuxcare.3.

TuxCare rebuilt 4 io.netty packages to address 10 CVEs. Fixed in 4.1.23.Final-tuxcare.2.

TuxCare rebuilt 43 io.netty packages to address 22 CVEs. Fixed in 4.1.60.Final-tuxcare.3.

TuxCare rebuilt 4 io.netty packages to address 8 CVEs. Fixed in 4.1.21.Final-tuxcare.3.

TuxCare rebuilt 5 io.netty packages to address 11 CVEs. Fixed in 4.1.42.Final-tuxcare.4.

TuxCare rebuilt 7 io.netty packages to address 16 CVEs. Fixed in 4.1.38.Final-tuxcare.2.

TuxCare rebuilt 8 io.netty packages to address 16 CVEs. Fixed in 4.1.39.Final-tuxcare.2.