Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and… (CVE-2026-50009)
Description
Netty QUIC versions prior to 4.2.15.Final expose the stateless reset token on the network path when using default HMAC-based connection-ID and stateless-reset-token generators. This exposure allows an on-path attacker to derive the reset token from QUIC headers after a source connection ID rotation and potentially perform a Denial of Service by sending spoofed Stateless Reset packets. The issue is fixed in version 4.2.15.Final.
CVSS v3.1
Score 4.8medium
Affected software
pkg:deb/ubuntu/netty?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/netty?arch=source&distro=esm-apps-legacy/xenialpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/netty?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/netty?arch=source&distro=questingpkg:deb/ubuntu/netty?arch=source&distro=stonkingpkg:deb/ubuntu/netty?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Netty is a network application framework used for protocol servers and clients. In versions before 4.2.15.Final, the QUIC implementation exposes the stateless reset token on the network path due to the use of default HMAC-based connection-ID and stateless-reset-token generators. Specifically, the reset token for the server's current source connection ID can be derived from bytes appearing as the connection ID in QUIC headers after a source-CID rotation. An attacker positioned on the network path can observe these headers and use the derived token to send spoofed Stateless Reset packets, causing a Denial of Service. The vulnerability is addressed in Netty version 4.2.15.Final.
Potential Impact
An on-path attacker can observe QUIC headers and derive the stateless reset token, enabling them to send spoofed Stateless Reset packets. This can result in a Denial of Service condition against the server. The confidentiality and integrity of data are not directly impacted, but availability is affected.
Mitigation Recommendations
Upgrade to Netty version 4.2.15.Final or later, where this vulnerability is patched. No other mitigation is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-50009
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f6142cdf04f65666415d
Added to database: 10/17/2026, 22:26:28 UTC
Last enriched: 10/18/2026, 01:02:31 UTC
Last updated: 10/18/2026, 01:02:31 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.