CVE-2026-50009

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.2.15.Final

Description Netty QUIC exposes the stateless reset token on the network path when utilizing the default HMAC-based connection-ID and stateless-reset-token generators. Specifically, the HmacSignQuicConnectionIdGenerator and HmacSignQuicResetTokenGenerator both evaluate HMAC-SHA256 using the same JVM-wide static key io.netty.handler.codec.quic.Hmac. During source CID rotation in the newSourceConnectionIds() function, the current server source CID is used to produce the next CID. If the length of the CID is 16 bytes or more, the first 16 bytes of the new CID are identical to the stateless reset token of the previous CID. Since the CID is transmitted in QUIC headers, an on-path attacker can observe these headers to derive the reset token and perform a Denial of Service by sending a spoofed Stateless Reset packet.

Recommendations Update to version 4.2.15.Final.