Junglewise Threat Intelligence

CVE-2026-100659: Netty HTTP/3 codec host header validation bypass

CVE-2026-100659 · Severity: medium · CVSS 6.5 · Published 2026-09-26

Technologies: Netty Project Codec HTTP3. Vendors: Netty Project.

Executive brief

Netty's HTTP/3 codec is a library that processes incoming web requests over the HTTP/3 protocol. An attacker can send a specially crafted request with conflicting host identifiers that different security systems interpret differently, allowing them to bypass routing rules and access controls that should protect sensitive resources.

Technical details

The HTTP/3 codec fails to validate RFC 9114 requirements that the :authority pseudo-header and host header field must match when both are present in a single HEADERS frame. An unauthenticated remote attacker can send a HEADERS frame with mismatched authority values, which the codec accepts and delivers to the application, enabling HTTP request smuggling and authorization bypass when downstream components consult different authority fields.

Affected products

  • Netty Project netty-codec-http3 4.2.0.Final through 4.2.17.Final

Timeline

  • 2026-09-26: disclosed
  • 2026-09-10: patched: Fix available in 4.2.18.Final

References

Related threats