Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Prior to
    versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar
    to HTTP/2 Rapid Reset. There is a setting in the http2 specification called
    `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will
    behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and
    create an exception while writing the headers for the response. Functionally, this should be similar to
    the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and
    4.2.15.Final patch the issue. (CVE-2026-50560)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Prior to     versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar     to HTTP/2 Rapid Reset. There is a setting in the http2 specification called     `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will     behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and     create an exception while writing the headers for the response. Functionally, this should be similar to     the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and     4.2.15.Final patch the issue. (CVE-2026-50560)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
443218	SCA: security update for io.netty:netty-codec-http2 (GHSA-563q-j3cm-6jxm)	Tenable Cloud Security	SCA Checks	medium
443218	SCA: security update for io.netty:netty-codec-http2 (GHSA-563q-j3cm-6jxm)	Tenable Self-Hosted Container Security	SCA Checks	medium
320901	Linux Distros Unpatched Vulnerability : CVE-2026-50560	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-50560

medium

Tenable Plugins

medium

medium

medium