RHLW-2026-1fd7d9ca33a37367: Lightwell Security Advisory: netty-codec-classes-quic 4.2.13.Final-rhlw-00014
Red Hat Lightwell has released io.netty:netty-codec-classes-quic 4.2.13.Final-rhlw-00014 with backported fixes for CVE-2026-44894 and CVE-2026-50009.
CVE-2026-44894: Netty's Default QUIC token handler accepts any client-supplied token
CVE-2026-50009: Netty QUIC stateless reset token material exposed through header-visible connection IDs
This patched artifact is a drop-in replacement for io.netty:netty-codec-classes-quic 4.2.13.Final from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/io.netty:netty-codec-classes-quicto a version that resolves this vulnerability.Fixed in 4.2.13.Final-rhlw-00014 - Upgrade
Upgrade
io.netty:netty-codec-classes-quicto a version that resolves this vulnerability.Fixed in 4.2.13.Final-rhlw-00014
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments are exposed?
Deployments using io.netty:netty-codec-classes-quic 4.2.13.Final from Maven Central are the relevant population identified by the advisory. The affected functionality is Netty QUIC handling.
Does exploiting either issue require authentication or user interaction?
No. The supplied severity vector indicates network attackability with low complexity, no privileges required, and no user interaction required.
What should teams upgrade to?
Replace io.netty:netty-codec-classes-quic 4.2.13.Final with Red Hat Lightwell's 4.2.13.Final-rhlw-00014 artifact. The advisory states that this patched artifact is a drop-in replacement and includes backported fixes for CVE-2026-44894 and CVE-2026-50009.