EUVD-2026-36462
GHSA-cq4q-cv5g-r8q5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
On-path position and CID rotation observation required (AC:H); no attacker authentication needed; token derivability warrants C:L; connection termination warrants A:L only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.
AnalysisAI
Stateless reset token leakage in Netty's QUIC codec (io.netty:netty-codec-classes-quic prior to 4.2.15.Final) enables an on-path attacker to derive the reset token for active connections and terminate them via spoofed Stateless Reset packets. The default HMAC-based generators expose a deterministic relationship between the source connection ID visible in QUIC headers and the server's stateless reset token - after a source-CID rotation, an observer can compute the token from the new connection-ID bytes. No public exploit identified at time of analysis; the CVSS 4.8 Medium rating reflects the on-path attacker prerequisite (AC:H), which meaningfully limits opportunistic exploitation.
Technical ContextAI
QUIC (RFC 9000) supports stateless reset packets, allowing endpoints to abort connections without per-connection state. Each connection ID has an associated stateless reset token; possession of this token allows any party to terminate the corresponding connection. Netty's default HMAC-based connection-ID and stateless-reset-token generator introduces a deterministic mathematical relationship between the connection ID - visible in QUIC packet headers on the network path - and the reset token. After a source-CID rotation, a normal QUIC protocol event, the new connection-ID bytes carry sufficient information for an on-path observer to reconstruct the reset token via the same HMAC operation. This is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) because a value that should remain private (the reset token) becomes derivable from public header fields. The affected artifact is io.netty:netty-codec-classes-quic, covered by CPE cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* for all Netty releases prior to 4.2.15.Final.
RemediationAI
Upgrade to Netty 4.2.15.Final, which patches this vulnerability along with multiple other security fixes in the same release batch. The patched release is available at https://github.com/netty/netty/releases/tag/netty-4.2.15.Final and via Maven Central as io.netty:netty-codec-classes-quic:4.2.15.Final. The security advisory is at https://github.com/netty/netty/security/advisories/GHSA-cq4q-cv5g-r8q5. If immediate upgrade is not possible, a targeted workaround is to replace the default HMAC-based connection-ID and stateless-reset-token generators with a custom implementation that does not derive the reset token from connection-ID bytes, removing the exploitable relationship; this requires Netty API familiarity and carries a regression risk if the replacement is not cryptographically sound. As a network-layer compensating control, restricting on-path access to QUIC traffic (e.g., encrypted tunnels, network segmentation, or limiting QUIC to trusted network segments) reduces attacker positioning opportunities but does not eliminate the underlying flaw and may not be feasible for internet-facing deployments.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to
Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today