CVE-2026-50560: Denial of Service in Netty HTTP/2 Codec via Max Header List Size Exception

Vulnerability ID: CVE-2026-50560
CVSS Score: 6.9
Published: 2026-06-15

CVE-2026-50560 describes a vulnerability in Netty's HTTP/2 codec implementation. When acting as an intermediary (such as a reverse proxy, API gateway, or edge server), Netty can be forced into an application-level Denial-of-Service condition. The attack is triggered by negotiating a restrictive SETTINGS_MAX_HEADER_LIST_SIZE from the client, causing Netty to process incoming requests fully, but subsequently crash or abort during outbound response serialization. This results in an asymmetrical consumption of resources on backend systems and thread starvation within the Netty event loop.

TL;DR

An unauthenticated remote attacker can cause a Denial-of-Service condition in Netty-based HTTP/2 servers by negotiating a very low max header list size. This forces server-side exceptions and stream resets during outbound serialization, evading standard client-driven reset detection mechanics.

Technical Details

• CWE ID: CWE-770
• Attack Vector: Network (Remote)
• CVSS v4.0 Score: 6.9 (Medium)
• EPSS Score: 0.00302
• Impact: Denial of Service (DoS)
• Exploit Status: none
• KEV Status: Not Listed

Affected Systems

• Netty HTTP/2 Gateway Servers
• Netty-based Reverse Proxies
• Java applications utilizing netty-codec-http2
• Netty: >= 4.1.0.Final, < 4.1.135.Final (Fixed in: 4.1.135.Final)
• Netty: >= 4.2.0.Final, < 4.2.15.Final (Fixed in: 4.2.15.Final)

Mitigation Strategies

• Upgrade Netty library dependencies to version 4.1.135.Final or 4.2.15.Final.
• Configure fronting reverse proxies to enforce a minimum settable limit on SETTINGS_MAX_HEADER_LIST_SIZE.
• Apply strict connection and concurrency rate limits at the perimeter to limit the volume of pipelined streams from a single source.

Remediation Steps:

1. Identify all projects and microservices using Netty by running a dependency tree check.
2. Update Maven pom.xml or Gradle build.gradle files to reference Netty version 4.1.135.Final or 4.2.15.Final.
3. Rebuild and redeploy the affected services to production.
4. Monitor application log files for HTTP/2 write or serialization exceptions to verify remediation success.

References

• Netty Security Advisory GHSA-563q-j3cm-6jxm
• Netty 4.1.135.Final Release
• Netty 4.2.15.Final Release
• RFC 9113 HTTP/2 Defined Settings

Read the full report for CVE-2026-50560 on our website for more details including interactive diagrams and full exploit analysis.