6.9

CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

Analyzed
AliasesUBUNTU-CVE-2026-50560DEBIAN-CVE-2026-50560CGA-2365-8qrx-8372
Published 12-06-2026Last modified 13-06-2026

Vulnerability summary

CVE-2026-50560 is a medium (CVSS 6.9) vulnerability in netty. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.5% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.52%
0%100%
Low · +0.22 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:11033-1SUSE-SU-2026:2802-1CGA-9FXF-69X8-J7WV

Timeline

  1. 12-06-2026
    PublishedVulnerability first disclosed.
  2. 13-06-2026
    Last modifiedVulnerability information updated.

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CVSS metrics

10 scores · 7 sources · 2 versions

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

44%

Versus all other CVEs

30-day change

Increase +0.22 pp

From 0.30% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard127 products
  • apache-hop< 2.18.0-r6
  • apache-pulsar-4.0< 4.0.11-r2
  • apache-pulsar-4.1< 4.1.3-r15
  • apache-pulsar-4.2< 4.2.2-r3
  • apache-pulsar-fips-4.0< 4.0.11-r2
Wolfi43 products
  • apache-pulsar-4.1< 4.1.3-r15
  • apache-pulsar-4.2< 4.2.2-r3
  • celeborn-0.6All versions (No fix recorded) | < 0.6.3-r8
  • docker-selenium-base< 4.44.0.20260505-r2
  • docker-selenium-hubAll versions (No fix recorded)
Debian1 product
  • nettyAll versions (No fix recorded)
Io.netty1 product
  • netty-codec-http2≥ 4.2.0.Final, < 4.2.15.Final | < 4.1.135.Final
Netty1 product
  • netty≥ 4.2.0.Final, < 4.2.15.Final | < 4.1.135.Final | < 4.1.135 | ≥ 4.2.0, < 4.2.15
Ubuntu1 product
  • nettyAll versions (No fix recorded)

6 vendors · 174 products

References

10 links