# CVE-2026-100663: Netty HTTP/3 codec CONNECT authority-form parsing bypass

Source: https://junglewise.ai/threats/cve-2026-100663-netty-s-http-3-codec-io-netty-netty-codec-http3-from-4-2-2-final  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100663 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty's HTTP/3 codec library mishandles conversion of HTTP/1 CONNECT requests, allowing an attacker to specify a different destination server than what was authorized. In HTTP/1-to-HTTP/3 proxy or gateway deployments, an attacker can craft a request that bypasses security controls such as tunnel allow-lists or egress policies by using a conflicting Host header. This enables unauthorized tunneling to attacker-controlled destinations.

Technologies: [Netty-Codec-Http3](https://junglewise.ai/threats/technologies/netty-codec-http3). Vendors: [Netty](https://junglewise.ai/threats/vendors/netty).

## Quick answers

**Is CVE-2026-100663 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100663 being exploited in the wild.

**How severe is CVE-2026-100663?** High severity, with a CVSS score of 7.5, published 26 September 2026.

**Which products and versions are affected?** Netty-Codec-Http3 4.2.2.Final through 4.2.17.Final.

**Is there a fix for CVE-2026-100663?** A patch was published on 2026-09-26: Fixed in version 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100663 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100663?** Check whether you run Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in HttpConversionUtil.toHttp3Headers(), which fails to special-case HTTP/1 CONNECT authority-form request-targets. When a CONNECT request like "CONNECT trusted.example:443" is supplied with a conflicting Host header (e.g., "Host: attacker.example:443"), Netty parses the target as a URI and incorrectly emits the Host header value as the HTTP/3 :authority pseudo-header, bypassing validation logic that checks the original request-target. The fix, available in 4.2.18.Final, properly extracts the authority from the CONNECT request-target and rejects conflicting Host headers.

## Affected products

- Netty netty-codec-http3 4.2.2.Final through 4.2.17.Final

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 4.2.18.Final

## References

- [https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627](https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627)
- [https://www.vulncheck.com/advisories/netty-http-1-connect-authority-form-mistranslated-to-malformed-http-3](https://www.vulncheck.com/advisories/netty-http-1-connect-authority-form-mistranslated-to-malformed-http-3)

## Related threats

- [Netty HTTP/3 QPACK encoder-stream unbounded memory consumption](https://junglewise.ai/threats/cve-2026-100662-netty-s-http-3-codec-io-netty-netty-codec-http3-versions-4-2-0)
- [Netty HTTP/3 codec QPACK prefixed-integer denial-of-service](https://junglewise.ai/threats/cve-2026-100661-netty-s-http-3-codec-io-netty-netty-codec-http3-versions-4-2-0)
- [Netty netty-codec-http3 unbounded QPACK encoder memory retention](https://junglewise.ai/threats/cve-2026-100660-netty-s-http-3-codec-io-netty-netty-codec-http3-from-4-2-0-final)