Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it without the 3× cap. The correct 'no token handler' semantics would be to return -1 (invalid) so the normal un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients.
    NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version
    4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but
    validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return
    from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to
    call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 §8.1,
    a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-
    empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to
    treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it
    without the 3× cap. The correct 'no token handler' semantics would be to return -1 (invalid) so the normal
    un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue. (CVE-2026-44894)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients.
    NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version     4.2.15.Final, its writeToken() returns false (server will not send Retry  acceptable), but     validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return     from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to     call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 8.1,     a validated address lifts the 3 anti-amplification send limit. Thus any attacker who includes ANY non-     empty token bytes in an Initial packet  with a spoofed victim source IP  causes the Netty server to     treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it     without the 3 cap. The correct 'no token handler' semantics would be to return -1 (invalid) so the normal     un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue. (CVE-2026-44894)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458822	Echo: io.netty:netty-codec-classes-quic: security update to 4.2.15.Final	Tenable Cloud Security	Echo Local Security Checks	Local	high
458822	Echo: io.netty:netty-codec-classes-quic: security update to 4.2.15.Final	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
320904	Linux Distros Unpatched Vulnerability : CVE-2026-44894	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-44894

high

Tenable Plugins

high

high

high