4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50009

CVE-2026-50009: Netty QUIC stateless reset token material exposed through header-visible connection IDs

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50009

CVE-2026-50009:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-classes-quic	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-50009, allowed an on-path attacker to perform a Denial of Service attack against Netty's QUIC implementation. The issue stemmed from the reuse of a single HMAC key for two different cryptographic operations: generating connection IDs and stateless reset tokens. According to RFC 9000, the stateless reset token must be difficult to guess, but because it was generated using the same key as the connection ID, it could be derived from the new connection ID that is sent in cleartext during connection migration.

The analysis of the patch in commit 2d81a2b6324377af64ad7930b61cde01568d2ed6 confirms this root cause. The io.netty.handler.codec.quic.Hmac class was modified to use two separate, independent keys (CID_KEY and TOKEN_KEY) for signing connection IDs and reset tokens, respectively. The original generic sign method was replaced with signCid and signToken. The calling functions, HmacSignQuicConnectionIdGenerator.newId and HmacSignQuicResetTokenGenerator.newResetToken, were updated to use these new, purpose-specific signing methods. This change cryptographically isolates the two values, ensuring that knowledge of the connection ID does not leak any information about the reset token, thereby mitigating the vulnerability.

Vulnerable functions

io.netty.handler.codec.quic.Hmac.sign

codec-classes-quic/src/main/java/io/netty/handler/codec/quic/Hmac.java

This function was the core of the vulnerability. It used a single HMAC key to sign both connection IDs and stateless reset tokens. This allowed an attacker to derive the reset token from a publicly visible connection ID, as both were generated from the same key.

io.netty.handler.codec.quic.HmacSignQuicConnectionIdGenerator.newId

codec-classes-quic/src/main/java/io/netty/handler/codec/quic/HmacSignQuicConnectionIdGenerator.java

This function generates a new connection ID. In the vulnerable version, it called the generic `Hmac.sign` method, which used the shared key. This is the function that produces the connection ID from which the reset token could be derived.

io.netty.handler.codec.quic.HmacSignQuicResetTokenGenerator.newResetToken

codec-classes-quic/src/main/java/io/netty/handler/codec/quic/HmacSignQuicResetTokenGenerator.java

This function generates the stateless reset token. In the vulnerable version, it called the generic `Hmac.sign` method, which used the same key as the connection ID generator, creating the link that led to the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.