CVE-2026-50560
Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
How to fix
- netty netty4.1.135, 4.2.15 or later
- io.netty:netty-codec-http24.2.15.Final, 4.1.135.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | v < 4.1.135, 4.2.0 ≤ v < 4.2.15 | 4.1.135, 4.2.15 |
| io.netty:netty-codec-http2Maven | 4.2.0.Final ≤ v < 4.2.15.Final, v < 4.1.135.Final | 4.2.15.Final, 4.1.135.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.