# CVE-2026-50560: Netty denial of service in HTTP/2 codec via max header size handling

Source: https://junglewise.ai/threats/cve-2026-50560-netty-denial-of-service-in-http-2-codec-via-max-header-size  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-50560 · Severity: medium · CVSS 5.3 · Published 2026-06-12

Netty, a popular networking framework for Java applications, is vulnerable to a denial-of-service attack. An attacker can send specific HTTP/2 configuration settings that cause the server to crash or become unresponsive while processing responses. This can lead to service outages and impact the availability of web applications and proxy services using the affected library.

Technologies: [io.netty:netty-codec-http2 (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-codec-http2). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-50560 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50560 being exploited in the wild.

**How severe is CVE-2026-50560?** Medium severity, with a CVSS score of 5.3, published 12 June 2026.

**Which products and versions are affected?** io.netty:netty-codec-http2 (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final; Netty Project Netty Codec HTTP/2 >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final.

**Is there a fix for CVE-2026-50560?** Yes. io.netty:netty-codec-http2 (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50560 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50560?** Check whether you run io.netty:netty-codec-http2 (Maven) or Netty Project Netty Codec HTTP/2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-codec-http2 (Maven): upgrade to 4.2.15.Final or later

  ```sh
  # set io.netty:netty-codec-http2 to 4.2.15.Final in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in Netty's handling of the HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE setting. When a client sends this advisory setting, Netty incorrectly attempts to honor it during response generation rather than treating it as advisory. This leads to an exception being thrown while writing response headers after the request has already been proxied to the origin. An attacker can exploit this to trigger resource exhaustion or service instability, similar to the HTTP/2 Rapid Reset attack but with a different on-the-wire signature. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final by ignoring the client-provided setting.

## Affected products

- Netty netty-codec-http2 >= 4.2.0.Final, <= 4.2.14.Final; <= 4.1.134.Final

## Identifiers

- CVE-2026-50560
- GHSA-563q-j3cm-6jxm

## Timeline

- 2026-06-08: disclosed
- 2026-06-12: advisory: NVD publication date
- 2026-06-15: patched: GitHub Advisory reviewed and updated

## References

- [https://api.github.com/users/ashleytolbert](https://api.github.com/users/ashleytolbert)
- [https://github.com/ashleytolbert](https://github.com/ashleytolbert)
- [https://api.github.com/users/ashleytolbert/gists%7B/gist_id%7D](https://api.github.com/users/ashleytolbert/gists%7B/gist_id%7D)
- [https://api.github.com/users/ashleytolbert/repos](https://api.github.com/users/ashleytolbert/repos)
- [https://avatars.githubusercontent.com/u/2242873?v=4](https://avatars.githubusercontent.com/u/2242873?v=4)
- [https://api.github.com/users/ashleytolbert/events%7B/privacy%7D](https://api.github.com/users/ashleytolbert/events%7B/privacy%7D)

## Related threats

- [Netty request smuggling via Host header duplication in HTTP/2 translation](https://junglewise.ai/threats/cve-2026-59900-netty-request-smuggling-via-host-header-duplication-in-http-2)
- [Netty memory leak in HTTP/2 content decompression](https://junglewise.ai/threats/cve-2026-56819-netty-memory-leak-in-http-2-content-decompression)
- [Netty memory exhaustion in DelegatingDecompressorFrameListener](https://junglewise.ai/threats/cve-2026-48043-netty-memory-exhaustion-in-delegatingdecompressorframelistener)
- [Netty uncontrolled resource consumption in HTTP/2 codec](https://junglewise.ai/threats/cve-2026-47244-netty-uncontrolled-resource-consumption-in-http-2-codec)
- [Netty denial of service via decompression limit bypass](https://junglewise.ai/threats/cve-2026-42587-netty-denial-of-service-via-decompression-limit-bypass)