Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Summary
Netty HTTP/2 max header size handling produces attack similar to HTTP/2 Rapid Reset.
Details
There is a setting in the http2 specification called SETTINGS_MAX_HEADER_LIST_SIZE. According to the RFC: “This advisory setting informs a peer of the maximum field section size that the sender is prepared to accept, in units of octets.”
When a client sends that setting to Netty, it appears that Netty will behave as follows:
- Read the request
- Proxy the request to the origin
- Attempt to produce a response
- Create an exception while writing the headers for the response
Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature.
Remediation
When speaking with clients, Netty should potentially treat this as “advisory” and ignore it. It would be best to ignore the SETTINGS_MAX_HEADER_LIST_SIZE setting from clients (or ignore it when sending to clients). According to the spec, a server does not need to honor this advisory setting, and it appears that other http/2 implementations ignore it when acting as a server.
Impact
This is a DDoS attack similar to the HTTP/2 Rapid Reset Attack.
Credit
Jonathan Looney (Engineering, Netflix)
Contact
Ashley Tolbert (Security, Netflix) - artolbert@netflix.com
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | io.netty:netty-codec-http2 | >= 4.2.0.Final, < 4.2.15.Final, < 4.1.135.Final | 4.2.15.Final, 4.1.135.Final |
Referencias
- https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm
- https://nvd.nist.gov/vuln/detail/CVE-2026-50560
- https://github.com/netty/netty
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L- Debilidad (CWE)
CWE-770- Plataforma
- Java / Kotlin (Maven)
- Paquete
io.netty:netty-codec-http2- Publicada
- 15.06.2026
- Actualizado
- 11.10.2026 13:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-563q-j3cm-6jxm - CC BY 4.0
Historial de vulnerabilidades: io.netty:netty-codec-http2
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 11
- Primera → última
- 03.2021 07.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 5
- Media 6
Divulgaciones por año
- 2021: 2
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 1
- 2026: 7
-
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.