CVE-2026-100661 Details
Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.
A denial-of-service vulnerability has been identified in Netty's HTTP/3 codec, specifically in the QPACK prefixed-integer decoder, within versions 4.2.0.Final prior to 4.2.18.Final. The vulnerability arises because the decoder does not limit the number of continuation bytes processed. A remote, unauthenticated peer can exploit this by opening a QPACK unidirectional stream and sending a first byte with all prefix bits set, followed by an endless stream of continuation bytes. This causes the decoder to repeatedly request more bytes without consuming the input, leading to unbounded growth of the ByteToMessageDecoder cumulator. Each decode invocation rescans the entire accumulated buffer, resulting in quadratic CPU consumption. The combination of these factors causes unbounded heap growth per connection, triggering an OutOfMemoryError and starving the event loop of CPU resources.
Users can upgrade to Netty version 4.2.18.Final to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Oct 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/netty-http-3-qpack-prefixed-integer-dos-via-unbounded-accumulation | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Netty | >= 4.2.0.Final, <= 4.2.17.Final |
CPE
Remediation
| |
| Netty HTTP/3 | >= 4.2.0.Final, <= 4.2.17.Final |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 2, 2026 | CVE Modified | CISA-ADP |
| Sep 27, 2026 | CVE Modified | [email protected] |
| Sep 26, 2026 | New CVE Received | [email protected] |