Is CVE-2026-100660 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100660 being exploited in the wild.

How severe is CVE-2026-100660?

High severity, with a CVSS score of 7.5, published 26 September 2026.

Which products and versions are affected?

Netty-Codec-Http3 4.2.0.Final through 4.2.17.Final.

Is there a fix for CVE-2026-100660?

A patch was published on 2026-09-26: Fixed in 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-100660?

Check whether you run Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100660: Netty netty-codec-http3 unbounded QPACK encoder memory retention

CVE-2026-100660 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty's HTTP/3 library fails to limit memory used by its QPACK encoder when processing response headers. A remote attacker can send specially crafted requests that cause the server to accumulate unbounded memory until it runs out of heap space and crashes, disrupting service availability. No authentication is required and the attack works over standard internet connections.

Technologies: Netty-Codec-Http3. Vendors: Netty.

Quick answers

Is CVE-2026-100660 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100660 being exploited in the wild.
How severe is CVE-2026-100660?: High severity, with a CVSS score of 7.5, published 26 September 2026.
Which products and versions are affected?: Netty-Codec-Http3 4.2.0.Final through 4.2.17.Final.
Is there a fix for CVE-2026-100660?: A patch was published on 2026-09-26: Fixed in 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100660 attacked?: It is in a software library.
Am I affected by CVE-2026-100660?: Check whether you run Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The QpackEncoder retains per-stream dynamic-table index trackers in an unbounded map keyed by peer-controlled QUIC stream IDs, releasing entries only upon receipt of Section Acknowledgment or Stream Cancellation instructions from the decoder. An attacker can withhold these acknowledgments indefinitely while issuing sequential requests over a single QUIC connection, bypassing concurrent-stream limits and causing heap exhaustion. The vulnerability exists in versions 4.2.0.Final through 4.2.17.Final and is fixed in 4.2.18.Final.

Affected products

Netty netty-codec-http3 4.2.0.Final through 4.2.17.Final

Timeline

2026-09-26: disclosed
2026-09-26: patched: Fixed in 4.2.18.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.