CVE-2026-50009: Netty QUIC Stateless Reset DoS Vulnerability

CVE-2026-50009 Overview

CVE-2026-50009 affects Netty, an asynchronous event-driven network application framework used to build protocol servers and clients. The vulnerability exists in the Netty QUIC implementation prior to version 4.2.15.Final, where the stateless reset token leaks onto the network path. When the default HMAC-based connection-ID and stateless-reset-token generators are used, the reset token for the server's current source connection ID can be derived from bytes appearing in QUIC headers after a source-CID rotation. An on-path attacker who observes these headers can use the recovered token to send a spoofed Stateless Reset packet, terminating the targeted QUIC connection. The issue is classified as information exposure under [CWE-200].

Critical Impact
An on-path attacker can derive the stateless reset token from observed QUIC headers and force a denial of service against active QUIC connections by injecting spoofed Stateless Reset packets.

Affected Products

Netty versions prior to 4.2.15.Final using the QUIC codec
Deployments relying on the default HMAC-based connection-ID generator
Deployments relying on the default HMAC-based stateless-reset-token generator

Discovery Timeline

2026-06-12 - CVE-2026-50009 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50009

Vulnerability Analysis

Netty QUIC implements the QUIC transport protocol defined in RFC 9000. QUIC uses connection IDs (CIDs) to identify connections independently of the underlying IP/UDP four-tuple, and it uses stateless reset tokens to allow an endpoint that has lost state to abort a peer's connection. Each token is bound to a specific connection ID and must remain secret in transit.

In the affected versions, the default generator derives both the connection ID and its associated stateless reset token using the same HMAC-based construction. After a source connection ID rotation, bytes that the server emits as a new CID overlap with bytes that an attacker can use to reconstruct the reset token for the prior CID. The token is therefore observable to any on-path party that can read the QUIC long or short header.

The vulnerability does not enable code execution or data exfiltration. Its impact is limited to confidentiality of the reset token and availability of QUIC sessions built on the affected generators.

Root Cause

The root cause is an insufficient separation between the keying material and output domains of the connection-ID generator and the stateless-reset-token generator. Because both values are produced by the same HMAC-based construction over related inputs, knowledge of the post-rotation connection ID is sufficient to recompute the corresponding reset token without access to the server's secret state.

Attack Vector

The attacker must be on the network path between client and server to observe QUIC headers carrying the rotated source connection ID. After capturing the new CID, the attacker recomputes the matching stateless reset token and crafts a UDP datagram containing a spoofed Stateless Reset packet directed at the peer. The peer accepts the packet as a legitimate reset and tears down the QUIC connection, producing a denial of service. No authentication, user interaction, or prior access to server state is required, but the path-observation requirement raises attack complexity.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-cq4q-cv5g-r8q5 for the upstream technical description.

Detection Methods for CVE-2026-50009

Indicators of Compromise

Unexpected QUIC connection terminations correlated with Stateless Reset packets received from the peer's expected five-tuple shortly after a source-CID rotation.
Repeated abrupt session drops affecting multiple clients of the same Netty-based QUIC service without corresponding server-side errors.
UDP traffic anomalies in which Stateless Reset packets arrive from network segments inconsistent with the legitimate server path.

Detection Strategies

Inventory Java services that depend on netty:netty and identify modules using the QUIC codec at versions earlier than 4.2.15.Final.
Use software composition analysis to flag transitive dependencies pulling in vulnerable Netty QUIC builds.
Correlate application-layer disconnect events with packet captures showing Stateless Reset frames following CID rotation.

Monitoring Recommendations

Enable QUIC transport-level logging in Netty applications and alert on elevated rates of stateless reset events per client.
Monitor for asymmetric path conditions where Stateless Reset packets originate from unexpected upstream hops.
Track dependency manifests in CI/CD pipelines to detect reintroduction of pre-4.2.15.Final Netty versions.

How to Mitigate CVE-2026-50009

Immediate Actions Required

Upgrade all Netty deployments to version 4.2.15.Final or later, which patches the token derivation issue.
Identify and update internal libraries, frameworks, and containers that bundle vulnerable Netty QUIC builds.
Restart affected services after upgrade so that new connection IDs and reset tokens are generated by the patched code.

Patch Information

The fix is included in Netty 4.2.15.Final. The upstream advisory GHSA-cq4q-cv5g-r8q5 documents the change to the HMAC-based connection-ID and stateless-reset-token generators so that reset tokens are no longer recoverable from observed connection IDs.

Workarounds

Replace the default HMAC-based connection-ID and stateless-reset-token generators with custom implementations that derive the two values from independent secrets.
Disable the QUIC transport on Netty endpoints where upgrading is not immediately feasible and restrict clients to TLS over TCP.
Restrict exposure of Netty QUIC endpoints to trusted network segments to reduce the on-path observation surface until patches are deployed.

bash

# Configuration example: upgrade Netty to the patched version in Maven
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.2.15.Final
mvn versions:use-dep-version -Dincludes=io.netty:netty-codec-quic -DdepVersion=4.2.15.Final -DforceVersion=true
mvn clean verify