Is CVE-2026-100662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100662 being exploited in the wild.

How severe is CVE-2026-100662?

High severity, with a CVSS score of 7.5, published 26 September 2026.

Which products and versions are affected?

Netty-Codec-Http3 4.2.0.Final through 4.2.17.Final.

Is there a fix for CVE-2026-100662?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100662 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100662?

Check whether you run Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100662: Netty HTTP/3 QPACK encoder-stream unbounded memory consumption

CVE-2026-100662 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty's HTTP/3 codec library handles real-time communication protocols used by modern web applications. A flaw in its QPACK encoder allows remote attackers to exhaust server memory by declaring extremely large string lengths and sending data slowly, forcing the server to hold gigabytes in memory per connection. This causes the server to run out of memory and crash, disrupting service availability.

Technologies: Netty-Codec-Http3. Vendors: Netty.

Quick answers

Is CVE-2026-100662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100662 being exploited in the wild.
How severe is CVE-2026-100662?: High severity, with a CVSS score of 7.5, published 26 September 2026.
Which products and versions are affected?: Netty-Codec-Http3 4.2.0.Final through 4.2.17.Final.
Is there a fix for CVE-2026-100662?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100662 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100662?: Check whether you run Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The QpackEncoderHandler decoder in netty-codec-http3 accepts attacker-controlled string-literal lengths up to Integer.MAX_VALUE without enforcing caps or cumulation limits, allowing a remote unauthenticated peer on an established HTTP/3 connection to trigger unbounded per-connection heap accumulation. When declared length exceeds available bytes, the default MERGE cumulator retains all received data and grows toward ~2 GiB, eventually triggering a large byte-array allocation and OutOfMemoryError. The vulnerability is patched in version 4.2.18.Final.

Affected products

Netty netty-codec-http3 4.2.0.Final through 4.2.17.Final

Timeline

2026-09-26: disclosed: CVE-2026-100662 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.