PT-2026-47605 · Netty · Netty

Published 2026-06-08 · Updated 2026-06-12 · CVE-2026-44894

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Netty (ionettyincubatorcodecquic) (affected versions not specified)

Description The NoQuicTokenHandler component fails to properly validate tokens when no specific token handler is set by the application. Specifically, the validateToken() function unconditionally returns 0, which the QuicheQuicServerCodec.handlePacket() function interprets as a valid token. This allows an attacker to spoof a victim's source IP address and include any non-empty token bytes in an Initial packet. Consequently, the server treats the victim's address as validated, bypassing the 3x anti-amplification send limit defined in RFC 9000 §8.1. This enables the server to reflect full-size handshake flights, such as certificates, toward the victim without the standard amplification restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-940

Related Identifiers

CVE-2026-44894

GHSA-CMM3-54F8-PX4J

Affected Products

Netty

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-44894 · Security Note
• https://osv.dev/vulnerability/GHSA-cmm3-54f8-px4j · Vendor Advisory
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/security/advisories/GHSA-cmm3-54f8-px4j · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://twitter.com/dailycve/status/2064155476795777393 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2065516988126875779 · Twitter Post