CVE-2026-50560
ADVISORY - githubSummary
Summary
Netty HTTP/2 max header size handling produces attack similar to HTTP/2 Rapid Reset.
Details
There is a setting in the http2 specification called SETTINGS_MAX_HEADER_LIST_SIZE. According to the RFC: “This advisory setting informs a peer of the maximum field section size that the sender is prepared to accept, in units of octets.”
When a client sends that setting to Netty, it appears that Netty will behave as follows:
- Read the request
- Proxy the request to the origin
- Attempt to produce a response
- Create an exception while writing the headers for the response
Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature.
Remediation
When speaking with clients, Netty should potentially treat this as “advisory” and ignore it. It would be best to ignore the SETTINGS_MAX_HEADER_LIST_SIZE setting from clients (or ignore it when sending to clients). According to the spec, a server does not need to honor this advisory setting, and it appears that other http/2 implementations ignore it when acting as a server.
Impact
This is a DDoS attack similar to the HTTP/2 Rapid Reset Attack.
Credit
Jonathan Looney (Engineering, Netflix)
Contact
Ashley Tolbert (Security, Netflix) - artolbert@netflix.com
Common Weakness Enumeration (CWE)
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling
NIST
3.9
CVSS SCORE
6.9mediumGitHub
3.9
CVSS SCORE
6.9mediumDebian
-
Ubuntu
3.9
CVSS SCORE
5.3mediumChainguard
CGA-9fxf-69x8-j7wv
-
minimos
MINI-246m-x8j2-h773
-
minimos
MINI-28cw-wxv6-8242
-
minimos
MINI-29mp-c84q-fcrj
-
minimos
MINI-2hfc-w33h-9w7q
-
minimos
MINI-35p8-vr26-g363
-
minimos
MINI-363v-pxq9-vwvm
-
minimos
MINI-377g-6gvq-q932
-
minimos
MINI-3j9r-7pf8-hj8r
-
minimos
MINI-3qxj-m544-8crx
-
minimos
MINI-3r3m-hmhg-vpvh
-
minimos
MINI-3w8m-pj99-45f3
-
minimos
MINI-493p-77gc-mgv3
-
minimos
MINI-57f5-gv43-cc3x
-
minimos
MINI-5f42-c372-rpwq
-
minimos
MINI-5mvv-94r6-wx2x
-
minimos
MINI-5rx3-5w6w-54j6
-
minimos
MINI-5xrf-g7gw-vh4m
-
minimos
MINI-6464-3xfv-2vcj
-
minimos
MINI-6g7p-m9h3-wgm7
-
minimos
MINI-75pf-6xw6-7r69
-
minimos
MINI-77j4-h7gr-9g7q
-
minimos
MINI-784x-9pwm-6mf2
-
minimos
MINI-88pr-vp72-x7mq
-
minimos
MINI-8ghf-94j6-h2g6
-
minimos
MINI-8mx4-r7hm-vmx6
-
minimos
MINI-94qc-93jm-x749
-
minimos
MINI-97r5-g3vf-wfhr
-
minimos
MINI-9g63-c82v-j655
-
minimos
MINI-9j3r-745j-86gj
-
minimos
MINI-c4h5-8cvv-hwp4
-
minimos
MINI-c9qq-g9qm-49cq
-
minimos
MINI-cc2q-9h9c-fc54
-
minimos
MINI-cc84-f7p2-3833
-
minimos
MINI-cj3q-p274-g7fj
-
minimos
MINI-cpmh-xg94-5qm6
-
minimos
MINI-ff7j-crfp-949j
-
minimos
MINI-fg96-x9wx-jqpv
-
minimos
MINI-fgw6-mfxr-3qh7
-
minimos
MINI-fp3m-9w5h-qcmj
-
minimos
MINI-g2q9-wvfq-6hfv
-
minimos
MINI-g497-jj4r-3wcx
-
minimos
MINI-g7vp-g3v4-xrcm
-
minimos
MINI-h548-c4fv-fjvm
-
minimos
MINI-hg4c-xx39-crwh
-
minimos
MINI-hhmr-p6wc-cw6p
-
minimos
MINI-j2v3-2gwp-v2f3
-
minimos
MINI-j4hw-qmpm-xv7w
-
minimos
MINI-jcvv-3c2r-gvqq
-
minimos
MINI-jfxv-7373-v7xg
-
minimos
MINI-jj9w-g95v-h8mm
-
minimos
MINI-jxpm-2w5p-9gfx
-
minimos
MINI-m3q4-wc8f-jfxc
-
minimos
MINI-m6xh-36vv-55fm
-
minimos
MINI-m9qv-4vh9-9wcf
-
minimos
MINI-mgh7-3p64-mjpq
-
minimos
MINI-mmf7-8rcj-h6x3
-
minimos
MINI-mwwm-2259-j7g7
-
minimos
MINI-p5c9-wwpg-6hrq
-
minimos
MINI-p6f8-cv59-fwqr
-
minimos
MINI-pfr7-42fv-q3v9
-
minimos
MINI-pmrx-5wx5-8x46
-
minimos
MINI-q24q-h5m5-42m8
-
minimos
MINI-qfr7-7gr8-46j4
-
minimos
MINI-qjrr-vfvf-fxf3
-
minimos
MINI-vg45-xvxq-c8wq
-
minimos
MINI-vp3q-xpwq-fwmj
-
minimos
MINI-w5rj-phg2-243j
-
minimos
MINI-w7mq-786h-72pj
-
minimos
MINI-wfhh-c2cf-rj37
-
minimos
MINI-wgwv-74vv-pwmf
-
minimos
MINI-wmrj-c485-5885
-
minimos
MINI-x5mf-247p-88qr
-
minimos
MINI-x727-x23j-2xf3
-
minimos
MINI-xr5r-4r3m-x2x7
-