Executive brief
Netty's HTTP/3 codec processes compressed header fields sent by remote peers over QUIC connections. A flaw in the QPACK decoder allows an attacker to send specially crafted data that causes the server to consume unbounded memory and CPU, crashing the application or making it unresponsive to legitimate traffic.
Technical details
The QpackUtil.decodePrefixedInteger function lacks a bound on continuation bytes, allowing a remote attacker to send an indefinite sequence of 0x80 bytes that never terminates decoding. The decoder returns -1 ("need more bytes") on buffer exhaustion without consuming input, causing the ByteToMessageDecoder cumulator to grow without bound; each subsequent decode() invocation re-scans the accumulated buffer, yielding O(N²) CPU cost and eventual OutOfMemoryError or event-loop CPU starvation.
Affected products
- Netty netty-codec-http3 4.2.0.Final through 4.2.17.Final
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in 4.2.18.Final