{"cve":"CVE-2026-50560","nvd":{"published":"2026-06-12T16:16:32.847","modified":"2026-06-17T10:57:42.650","status":"Analyzed","description":"Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cwes":["CWE-770"],"references":["https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm","https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"],"products":["netty:netty"],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-50560","score":0.00397,"percentile":0.33923,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-563q-j3cm-6jxm","url":"https://osv.dev/vulnerability/GHSA-563q-j3cm-6jxm","summary":"Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature","modified":"2026-09-10T03:50:48.396944762Z","packages":[{"ecosystem":"Maven","name":"io.netty:netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2","ranges":[">=4.2.0.Final <4.2.15.Final"],"fixed":["4.2.15.Final"]},{"ecosystem":"Maven","name":"io.netty:netty-codec-http2","purl":"pkg:maven/io.netty/netty-codec-http2","ranges":["<4.1.135.Final"],"fixed":["4.1.135.Final"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}