# CVE-2026-100659: Netty HTTP/3 codec host header validation bypass

Source: https://junglewise.ai/threats/cve-2026-100659-netty-s-http-3-codec-io-netty-netty-codec-http3-in-versions-4-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100659 · Severity: medium · CVSS 6.5 · Published 2026-09-26

Netty's HTTP/3 codec is a library that processes incoming web requests over the HTTP/3 protocol. An attacker can send a specially crafted request with conflicting host identifiers that different security systems interpret differently, allowing them to bypass routing rules and access controls that should protect sensitive resources.

Technologies: [Netty Project Netty-Codec-Http3](https://junglewise.ai/threats/technologies/codec-http3). Vendors: [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-100659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100659 being exploited in the wild.

**How severe is CVE-2026-100659?** Medium severity, with a CVSS score of 6.5, published 26 September 2026.

**Which products and versions are affected?** Netty Project Netty-Codec-Http3 4.2.0.Final through 4.2.17.Final.

**Is there a fix for CVE-2026-100659?** A patch was published on 2026-09-10: Fix available in 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100659 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100659?** Check whether you run Netty Project Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The HTTP/3 codec fails to validate RFC 9114 requirements that the :authority pseudo-header and host header field must match when both are present in a single HEADERS frame. An unauthenticated remote attacker can send a HEADERS frame with mismatched authority values, which the codec accepts and delivers to the application, enabling HTTP request smuggling and authorization bypass when downstream components consult different authority fields.

## Affected products

- Netty Project netty-codec-http3 4.2.0.Final through 4.2.17.Final

## Timeline

- 2026-09-26: disclosed
- 2026-09-10: patched: Fix available in 4.2.18.Final

## References

- [https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm](https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm)
- [https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.18-http-3-request-routing-bypass](https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.18-http-3-request-routing-bypass)

## Related threats

- [Netty HTTP/3 codec Host header authority confusion](https://junglewise.ai/threats/cve-2026-100664-netty-s-http-3-codec-io-netty-netty-codec-http3-versions-4-2-2)