CVE-2026-50009: Netty QUIC Denial of Service via Stateless Reset Token Exposure

Executive brief

Netty, a popular networking framework for Java applications, contains a vulnerability in its QUIC protocol implementation. An attacker monitoring network traffic can discover sensitive security tokens that are supposed to be secret. Using these tokens, the attacker can force active network connections to close abruptly, leading to a denial of service for users.

Technical details

A vulnerability exists in Netty's QUIC implementation where the HmacSignQuicConnectionIdGenerator and HmacSignQuicResetTokenGenerator use the same static JVM-wide key and overlapping derivation logic. During source Connection ID (CID) rotation, the first 16 bytes of the new CID are identical to the stateless reset token of the previous CID. Since CIDs are transmitted in unencrypted QUIC headers, an on-path attacker can observe the new CID to learn the reset token for the current connection. This allows the attacker to send a spoofed Stateless Reset packet to terminate the connection. The issue is fixed in Netty 4.2.15.Final.

Affected products

• Netty netty-codec-classes-quic >= 4.2.0.Final, <= 4.2.14.Final

Timeline

• 2026-06-05: disclosed: Initial disclosure on GitHub
• 2026-06-12: advisory: NVD publication
• 2026-06-15: patched: GitHub advisory updated with patch information

References

• https://api.github.com/users/violetagg
• https://github.com/violetagg
• https://api.github.com/users/violetagg/gists%7B/gist_id%7D
• https://api.github.com/users/violetagg/repos
• https://avatars.githubusercontent.com/u/696661?v=4
• https://api.github.com/users/violetagg/events%7B/privacy%7D