CVE-2026-50560

Katalog CVE

CVSS 5.3 · Medium EPSS 0,52%

Kerentanan Allocation of Resources Without Limits or Throttling pada netty. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Rincian

Terbit di NVD

12 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm advisory vendor
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final release notes
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final release notes
• https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings not applicable