Executive brief
Netty's HTTP/3 codec is a library that processes incoming web requests over the HTTP/3 protocol. An attacker can send a specially crafted request with conflicting host identifiers that different security systems interpret differently, allowing them to bypass routing rules and access controls that should protect sensitive resources.
Technical details
The HTTP/3 codec fails to validate RFC 9114 requirements that the :authority pseudo-header and host header field must match when both are present in a single HEADERS frame. An unauthenticated remote attacker can send a HEADERS frame with mismatched authority values, which the codec accepts and delivers to the application, enabling HTTP request smuggling and authorization bypass when downstream components consult different authority fields.
Affected products
- Netty Project netty-codec-http3 4.2.0.Final through 4.2.17.Final
Timeline
- 2026-09-26: disclosed
- 2026-09-10: patched: Fix available in 4.2.18.Final