Netty HTTP/2 EUVD-2026-36471

HTTP/2 must be enabled and actively served by the target Netty deployment; services using only HTTP/1.1 are not affected. The affected component is specifically netty-codec-http2, so only applications that include this codec and negotiate HTTP/2 with external clients are vulnerable. No authentication is required - the attack operates at the HTTP/2 framing layer before any application-level authentication can execute (CVSS PR:N). No user interaction is needed. The attack is network-accessible (CVSS AV:N) with low complexity (AC:L): an attacker only needs network reachability to the HTTP/2 listener. The primary limiting factor is that the different on-wire signature from classic Rapid Reset may allow detection by protocol-aware inspection of SETTINGS frame sequences, though no specific countermeasure exists in unpatched Netty. Deployments behind a reverse proxy that validates or ignores client-advertised SETTINGS_MAX_HEADER_LIST_SIZE before forwarding to Netty reduce but may not eliminate exposure depending on whether the proxy passes through SETTINGS frames.

The official CVSS 4.0 score of 6.9 uses VA:L (low availability impact to the vulnerable system), which appears to underweight the potential DoS severity given the explicit analogy to HTTP/2 Rapid Reset - a technique used in record-breaking DDoS campaigns exceeding 398 million requests per second. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, low-complexity, network-accessible exploitation with no user interaction, meaning the barrier to attack is essentially zero once the attacker identifies a target running Netty over HTTP/2. EPSS at 0.02% and 5th percentile indicates very low observed exploitation probability currently, and the vulnerability is not in the CISA KEV catalog. However, the different on-wire signature compared to Rapid Reset is a concern: existing WAF and DDoS-mitigation rules tuned for CVE-2023-44487 may not detect or throttle this variant. The absence of a public PoC and low EPSS suggest opportunistic mass exploitation is not imminent, but targeted use against Netty-based infrastructure (API gateways, microservice proxies) by actors aware of the vulnerability is plausible. Confidentiality and integrity are unaffected - this is a pure availability issue.

An attacker sends a stream of HTTP/2 connections to a Netty-based service, each advertising a very small SETTINGS_MAX_HEADER_LIST_SIZE. For each stream, Netty reads the request body, proxies it to the origin backend, and then fails with an exception when it cannot serialize the response headers within the declared limit. By rapidly repeating this cycle across many streams or connections, the attacker exhausts Netty's I/O thread pool and connection backlog, rendering the service unavailable to legitimate clients - functionally identical to Rapid Reset but using a different framing sequence that may bypass CVE-2023-44487 detection rules. No public PoC has been identified at time of analysis.