Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M
CVE-2026-50560Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Medium 6.9
In plain English
A medium-severity resource allocation without limits in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | no fix listed | DEBIAN-CVE-2026-50560 |
| Debian:13 | netty | no fix listed | DEBIAN-CVE-2026-50560 |
| Debian:14 | netty | no fix listed | DEBIAN-CVE-2026-50560 |
| Maven | io.netty:netty-codec-http2 | 4.1.135.Final | GHSA-563q-j3cm-6jxm |
| Maven | io.netty:netty-codec-http2 | 4.2.15.Final | GHSA-563q-j3cm-6jxm |
| Ubuntu:25.10 | netty | no fix listed | UBUNTU-CVE-2026-50560 |
| Ubuntu:26.10 | netty | no fix listed | UBUNTU-CVE-2026-50560 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm x_refsource_CONFIRM
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final x_refsource_MISC
- https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings x_refsource_MISC