Executive brief
Netty's HTTP/3 codec library mishandles conversion of HTTP/1 CONNECT requests, allowing an attacker to specify a different destination server than what was authorized. In HTTP/1-to-HTTP/3 proxy or gateway deployments, an attacker can craft a request that bypasses security controls such as tunnel allow-lists or egress policies by using a conflicting Host header. This enables unauthorized tunneling to attacker-controlled destinations.
Technical details
The vulnerability exists in HttpConversionUtil.toHttp3Headers(), which fails to special-case HTTP/1 CONNECT authority-form request-targets. When a CONNECT request like "CONNECT trusted.example:443" is supplied with a conflicting Host header (e.g., "Host: attacker.example:443"), Netty parses the target as a URI and incorrectly emits the Host header value as the HTTP/3 :authority pseudo-header, bypassing validation logic that checks the original request-target. The fix, available in 4.2.18.Final, properly extracts the authority from the CONNECT request-target and rejects conflicting Host headers.
Affected products
- Netty netty-codec-http3 4.2.2.Final through 4.2.17.Final
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 4.2.18.Final