# CVE-2026-100661: Netty HTTP/3 codec QPACK prefixed-integer denial-of-service

Source: https://junglewise.ai/threats/cve-2026-100661-netty-s-http-3-codec-io-netty-netty-codec-http3-versions-4-2-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100661 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty's HTTP/3 codec processes compressed header fields sent by remote peers over QUIC connections. A flaw in the QPACK decoder allows an attacker to send specially crafted data that causes the server to consume unbounded memory and CPU, crashing the application or making it unresponsive to legitimate traffic.

Technologies: [Netty-Codec-Http3](https://junglewise.ai/threats/technologies/netty-codec-http3). Vendors: [Netty](https://junglewise.ai/threats/vendors/netty).

## Quick answers

**Is CVE-2026-100661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100661 being exploited in the wild.

**How severe is CVE-2026-100661?** High severity, with a CVSS score of 7.5, published 26 September 2026.

**Which products and versions are affected?** Netty-Codec-Http3 4.2.0.Final through 4.2.17.Final.

**Is there a fix for CVE-2026-100661?** A patch was published on 2026-09-26: Fixed in 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100661 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100661?** Check whether you run Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The QpackUtil.decodePrefixedInteger function lacks a bound on continuation bytes, allowing a remote attacker to send an indefinite sequence of 0x80 bytes that never terminates decoding. The decoder returns -1 ("need more bytes") on buffer exhaustion without consuming input, causing the ByteToMessageDecoder cumulator to grow without bound; each subsequent decode() invocation re-scans the accumulated buffer, yielding O(N²) CPU cost and eventual OutOfMemoryError or event-loop CPU starvation.

## Affected products

- Netty netty-codec-http3 4.2.0.Final through 4.2.17.Final

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in 4.2.18.Final

## References

- [https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx](https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx)
- [https://www.vulncheck.com/advisories/netty-http-3-qpack-prefixed-integer-dos-via-unbounded-accumulation](https://www.vulncheck.com/advisories/netty-http-3-qpack-prefixed-integer-dos-via-unbounded-accumulation)

## Related threats

- [Netty HTTP/3 codec CONNECT authority-form parsing bypass](https://junglewise.ai/threats/cve-2026-100663-netty-s-http-3-codec-io-netty-netty-codec-http3-from-4-2-2-final)
- [Netty HTTP/3 QPACK encoder-stream unbounded memory consumption](https://junglewise.ai/threats/cve-2026-100662-netty-s-http-3-codec-io-netty-netty-codec-http3-versions-4-2-0)
- [Netty netty-codec-http3 unbounded QPACK encoder memory retention](https://junglewise.ai/threats/cve-2026-100660-netty-s-http-3-codec-io-netty-netty-codec-http3-from-4-2-0-final)