A vulnerability identified as CVE-2026-50009 in Netty's QUIC implementation allows on-path attackers to derive stateless reset tokens from connection IDs, enabling denial-of-service (DoS) attacks. The flaw stems from the reuse of a single HMAC key for generating both connection IDs and reset tokens in versions 4.2.0.Final through 4.2.14.Final. Netty has released a patch in version 4.2.15.Final which cryptographically isolates the two values using distinct keys.