Executive brief
Netty's HTTP/3 library fails to limit memory used by its QPACK encoder when processing response headers. A remote attacker can send specially crafted requests that cause the server to accumulate unbounded memory until it runs out of heap space and crashes, disrupting service availability. No authentication is required and the attack works over standard internet connections.
Technical details
The QpackEncoder retains per-stream dynamic-table index trackers in an unbounded map keyed by peer-controlled QUIC stream IDs, releasing entries only upon receipt of Section Acknowledgment or Stream Cancellation instructions from the decoder. An attacker can withhold these acknowledgments indefinitely while issuing sequential requests over a single QUIC connection, bypassing concurrent-stream limits and causing heap exhaustion. The vulnerability exists in versions 4.2.0.Final through 4.2.17.Final and is fixed in 4.2.18.Final.
Affected products
- Netty netty-codec-http3 4.2.0.Final through 4.2.17.Final
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in 4.2.18.Final