Netty QUIC CVE-2026-50009

The attacker must occupy an on-path network position between the QUIC client and server, meaning the attacker can observe QUIC packet headers as they traverse the network path - a passive wiretap, compromised router, or co-located host on the same segment would satisfy this requirement. The server must be using Netty's default HMAC-based connection-ID and stateless-reset-token generators; applications that supply custom generator implementations are not affected. A source-CID rotation must occur on the monitored connection, which is a normal QUIC protocol event but not guaranteed to happen immediately upon connection establishment. No authentication, account access, or prior relationship with the target is required by the attacker. Exploitation is specifically limited by: (1) the on-path network requirement - remote arbitrary internet hosts cannot exploit this without network-level positioning; (2) the dependency on default generator configuration; and (3) the need to observe and correctly time the CID rotation event.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) yields a score of 4.8 Medium. The AC:H metric accurately reflects that exploitation demands an on-path network position and observation of a source-CID rotation event, making mass or opportunistic exploitation from arbitrary internet hosts unrealistic. Confidentiality impact is rated Low (C:L), capturing the information-disclosure component (token derivability), while availability impact is rated Low (A:L), reflecting the ability to terminate individual QUIC connections rather than causing persistent service outage. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing and no public proof-of-concept reported, consistent with a medium-risk rating. The chained nature of the vulnerability - information disclosure enabling targeted DoS - is operationally notable for services relying on QUIC for high-availability transport, even though neither impact is rated high in isolation. Organizations with Netty QUIC endpoints exposed on internet-accessible networks using default generator settings face the most realistic risk profile.

An attacker with on-path access between a QUIC client and a Netty-based server - such as a malicious ISP node, compromised router, or co-located adversary - passively monitors QUIC packet headers during normal traffic. After a source-CID rotation event, the attacker extracts the new connection-ID bytes and applies the same HMAC derivation used by Netty's default generator to compute the stateless reset token. The attacker then crafts a spoofed Stateless Reset packet containing the derived token and injects it toward the server or client, causing the targeted endpoint to interpret it as a legitimate reset and abruptly terminate the QUIC connection.