Executive brief
Netty is a popular framework used by developers to build high-performance network applications. A flaw in its QUIC protocol implementation allows attackers to trick a server into sending large amounts of data to a third-party victim. This can be used to launch distributed denial-of-service (DDoS) attacks by amplifying traffic directed at a target's network.
Technical details
The vulnerability exists in the NoQuicTokenHandler component of netty-codec-classes-quic. The validateToken() method unconditionally returns 0, which QuicheQuicServerCodec.handlePacket() interprets as a valid token. This bypasses the RFC 9000 §8.1 anti-amplification limit, which normally restricts a server from sending more than three times the data it has received from an unvalidated address. An attacker can send an Initial packet with a spoofed source IP and any non-empty token, causing the server to reflect large handshake flights (such as certificates) at the victim. The issue is resolved in version 4.2.15.Final by ensuring the handler returns -1 to indicate an invalid token.
Affected products
- Netty netty-codec-classes-quic >= 4.2.0.Final, <= 4.2.14.Final
Timeline
- 2026-06-02: patched: Version 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: NVD publication date