Executive brief
Netty's HTTP/3 codec library handles real-time communication protocols used by modern web applications. A flaw in its QPACK encoder allows remote attackers to exhaust server memory by declaring extremely large string lengths and sending data slowly, forcing the server to hold gigabytes in memory per connection. This causes the server to run out of memory and crash, disrupting service availability.
Technical details
The QpackEncoderHandler decoder in netty-codec-http3 accepts attacker-controlled string-literal lengths up to Integer.MAX_VALUE without enforcing caps or cumulation limits, allowing a remote unauthenticated peer on an established HTTP/3 connection to trigger unbounded per-connection heap accumulation. When declared length exceeds available bytes, the default MERGE cumulator retains all received data and grows toward ~2 GiB, eventually triggering a large byte-array allocation and OutOfMemoryError. The vulnerability is patched in version 4.2.18.Final.
Affected products
- Netty netty-codec-http3 4.2.0.Final through 4.2.17.Final
Timeline
- 2026-09-26: disclosed: CVE-2026-100662 published