Netty’s default QUIC token handler incorrectly treats any non‑empty client‑supplied token as valid, granting the client a fake address validation. This bypasses the RFC 9000 anti‑amplification "3×" limit that normally caps outgoing traffic from a QUIC server, allowing an attacker to trigger full handshake flights to a victim’s IP without the limit. The flaw is a classic example of unauthorized resource access (CWE‑940), and can be used to perform amplification attacks that overload the victim with large packets.

The vulnerability affects any Netty deployment that uses the default NoQuicTokenHandler and has not applied the 4.2.15.Final release or later. All Netty users running a QUIC server component prior to version 4.2.15.Final are impacted. The fix is delivered in Netty 4.2.15.Final and subsequent releases.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of < 1 % suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely with a spoofed source IP and any non‑empty token, translating into potentially large outgoing traffic that evades normal amplification controls.