CVE-2026-100660 Details
Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controlled QUIC stream ID, and these entries are released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation instruction — not when the HTTP/3 stream completes. There is no limit on the number of tracked streams, field sections, or retained bytes. A remote, unauthenticated HTTP/3 client can advertise a non-zero QPACK dynamic-table capacity, acknowledge the table insertion so the server reuses a dynamically indexed response header, and then omit all mandatory Section Acknowledgments while issuing sequential requests over a single QUIC connection, bypassing concurrent-stream limits and causing unbounded heap growth until the server exhausts memory (denial of service). Fixed in 4.2.18.Final.
A denial-of-service vulnerability has been identified in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final. The issue arises because the QpackEncoder component retains an unbounded amount of per-stream state related to the QPACK encoder. This retention occurs for every encoded field section that references the QPACK dynamic table, with the state being tracked by the peer-controlled QUIC stream ID. The retained entries are only released when the remote decoder sends a Section Acknowledgment or Stream Cancellation instruction, not when the HTTP/3 stream concludes. As a result, there is no limit on the number of tracked streams, field sections, or retained bytes. Exploitation can be carried out by a remote, unauthenticated HTTP/3 client that advertises a non-zero QPACK dynamic-table capacity, acknowledges the insertion of a dynamically indexed response header, and then fails to send the required Section Acknowledgments while making sequential requests over a single QUIC connection. This bypasses the concurrent-stream limits and leads to unbounded heap growth, causing the server to exhaust its memory and potentially fail.
Users can upgrade to Netty version 4.2.18.Final or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/netty-before-4.2.18-final-qpackencoder-unbounded-memory-retention | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Netty | >= 4.2.0.Final, <= 4.2.17.Final |
CPE
Remediation
| |
| Netty HTTP/3 | >= 4.2.0.Final, <= 4.2.17.Final |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 27, 2026 | CVE Modified | [email protected] |
| Sep 26, 2026 | New CVE Received | [email protected] |