Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Prior to version
    4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default
    HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current
    source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a
    source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of
    Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.
    (CVE-2026-50009)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Prior to version     4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default     HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current     source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a     source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of     Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.
    (CVE-2026-50009)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458889	Echo: io.netty:netty-codec-classes-quic: security update to 4.2.15.Final	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458889	Echo: io.netty:netty-codec-classes-quic: security update to 4.2.15.Final	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
443255	SCA: security update for io.netty:netty-codec-classes-quic (GHSA-cq4q-cv5g-r8q5)	Tenable Cloud Security	SCA Checks	Local	medium
443255	SCA: security update for io.netty:netty-codec-classes-quic (GHSA-cq4q-cv5g-r8q5)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
320922	Linux Distros Unpatched Vulnerability : CVE-2026-50009	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-50009

medium

Tenable Plugins

medium

medium

medium

medium

medium