Loading vulnerability…
Netty QUIC Anti-Amplification Bypass
CVE-2026-44894 is an improper source-verification flaw in Netty QUIC servers using the default NoQuicTokenHandler in io.netty:netty-codec-classes-quic versions 4.2.0.Final through 4.2.14.Final. The handler's validateToken() method returned 0 for arbitrary tokens, while the QUIC server codec interpreted every non-negative return value as successful token validation and an original destination connection ID offset. Consequently, any non-empty token in a QUIC Initial packet caused the server to consider the claimed client address validated. This incorrectly bypassed the RFC 9000 address-validation anti-amplification restriction that otherwise limits server transmission to three times the bytes received from an unvalidated address.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can use spoofed-source QUIC Initial packets to cause a vulnerable server to reflect full handshake flights, potentially including certificates and server transport parameters, to an arbitrary victim. Since the server treats the spoofed address as validated, it transmits without the normal 3x anti-amplification cap. This enables UDP reflection and traffic-amplification denial-of-service against third parties. Exploitation does not provide direct code execution or unauthorized access to the Netty server.
If you can’t patch tonight, do this now.
Where immediate upgrading is not feasible, configure a custom QuicTokenHandler that performs proper token validation. A temporary handler that returns -1 for all supplied tokens prevents unvalidated clients from being treated as address-validated, although it disables Retry-token validation. Restrict public exposure of vulnerable QUIC/UDP listeners where operationally possible and apply upstream anti-spoofing and UDP abuse controls.
Patch, then assume compromise.
Upgrade io.netty:netty-codec-classes-quic to Netty 4.2.15.Final or later. The corrected implementation treats tokens as invalid when no token handler is configured, preserving the unvalidated-client anti-amplification limit. Validate that all packaged, transitive, and shaded Netty QUIC dependencies are updated.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.