Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally return 0. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as token is valid, ODCID starts at offset 0, causing the server to call quiche_accept as if the clients address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it without the 3× cap. The correct no token handler semantics would be to return -1 (invalid) so the normal un-validated path and amplification limit apply. Version 4.2.15.Final patches the issue.
Weakness
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Netty | Netty | 4.2.0 (including) | 4.2.15 (excluding) |
| Netty | Ubuntu | questing | * |
Potential Mitigations
- Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack.
- When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/500.html
- https://cwe.mitre.org/data/definitions/594.html
- https://cwe.mitre.org/data/definitions/595.html
- https://cwe.mitre.org/data/definitions/596.html
References
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://github.com/netty/netty/security/advisories/GHSA-cmm3-54f8-px4j
- https://access.redhat.com/security/cve/CVE-2026-44894
- https://bugzilla.redhat.com/show_bug.cgi?id=2488380
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44894.json