https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:51:43 +0000 https://vulnerability.circl.lu/vuln/ghsa-cmm3-54f8-px4j <p><strong>Affected:</strong> Maven: io.netty:netty-codec-classes-quic</p> <p>NoQuicTokenHandler is the tokenHandler used when the application does not set one. Its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as &#39;token is valid, ODCID starts at offset 0&#39;, causing the server to call quiche_accept as if the client&#39;s address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it without the 3× cap. The correct &#39;no token handler&#39; semantics would be to return -1 (invalid) so the normal un-validated path and amplification limit apply.</p> <p><strong>Affected:</strong> Maven: io.netty:netty-codec-classes-quic</p> <p>NoQuicTokenHandler is the tokenHandler used when the application does not set one. Its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as &#39;token is valid, ODCID starts at offset 0&#39;, causing the server to call quiche_accept as if the client&#39;s address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplification send limit. Thus any attacker who includes ANY non-empty token bytes in an Initial packet — with a spoofed victim source IP — causes the Netty server to treat the victim as validated and reflect full-size handshake flights (certificates, etc.) toward it without the 3× cap. The correct &#39;no token handler&#39; semantics would be to return -1 (invalid) so the normal un-validated path and amplification limit apply.</p> https://vulnerability.circl.lu/vuln/ghsa-cmm3-54f8-px4j