CVE-2026-100663 Details
Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., "CONNECT trusted.example:443") is parsed as a URI, so its host is emitted as :scheme, :path is set to "/", and the HTTP/1 Host header is used as :authority; if no Host header is present the CONNECT target is dropped. In a Netty-based HTTP/1-to-HTTP/3 proxy or gateway, a remote client can send a CONNECT request whose Host header names a different authority than the request-target, producing a malformed HTTP/3 CONNECT whose tunnel :authority is attacker-controlled. This can bypass tunnel allow-lists, egress policy, backend selection, or audit controls that validate the HTTP/1 CONNECT request-target before forwarding over HTTP/3. The issue is fixed in 4.2.18.Final.
A vulnerability exists in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final. The issue arises because the codec does not properly handle HTTP/1 CONNECT requests that use authority-form request-targets when converting messages from HTTP/1 to HTTP/3. Instead of correctly mapping the authority-form target to the appropriate HTTP/3 headers, the conversion process misinterprets the target as a URI. This leads to the incorrect emission of the ':scheme' and ':path' headers, while the ':authority' header is derived from the HTTP/1 Host header. If the Host header is absent, the CONNECT target is discarded. In a Netty-based HTTP/1-to-HTTP/3 proxy or gateway, this flaw allows a remote client to send a CONNECT request with a Host header that differs from the request-target, resulting in a malformed HTTP/3 CONNECT request. The ':authority' header in this case becomes controlled by the attacker, potentially bypassing security measures that validate the HTTP/1 CONNECT request-target before forwarding it over HTTP/3.
Users can upgrade to Netty version 4.2.18.Final, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/netty-http-1-connect-authority-form-mistranslated-to-malformed-http-3 | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Netty | >= 4.2.2.Final, <= 4.2.17.Final |
CPE
Remediation
| |
| Netty HTTP/3 codec | >= 4.2.2.Final, <= 4.2.17.Final |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 27, 2026 | CVE Modified | [email protected] |
| Sep 26, 2026 | New CVE Received | [email protected] |