Is CVE-2026-100664 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100664 being exploited in the wild.

How severe is CVE-2026-100664?

High severity, with a CVSS score of 7.5, published 26 September 2026.

Which products and versions are affected?

Netty Project Netty-Codec-Http3 4.2.2.Final through 4.2.17.Final.

Is there a fix for CVE-2026-100664?

A patch was published on 2026-09-26: Fixed in 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100664 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100664?

Check whether you run Netty Project Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100664: Netty HTTP/3 codec Host header authority confusion

CVE-2026-100664 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty's HTTP/3 library incorrectly prioritizes the HTTP/1 Host header over the request URL when converting HTTP/1 requests to HTTP/3, which could trick intermediary gateways or proxies into routing traffic to an attacker-controlled destination. In an HTTP/1-to-HTTP/3 gateway or proxy, an attacker can send a request to one domain in the URL but specify a different domain in the Host header, causing the upstream HTTP/3 service to use the wrong destination. This can bypass virtual-host routing, allowlist checks, and other security controls that rely on the correct authority.

Technologies: Netty Project Netty-Codec-Http3. Vendors: Netty Project.

Quick answers

Is CVE-2026-100664 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100664 being exploited in the wild.
How severe is CVE-2026-100664?: High severity, with a CVSS score of 7.5, published 26 September 2026.
Which products and versions are affected?: Netty Project Netty-Codec-Http3 4.2.2.Final through 4.2.17.Final.
Is there a fix for CVE-2026-100664?: A patch was published on 2026-09-26: Fixed in 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100664 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100664?: Check whether you run Netty Project Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in HttpConversionUtil.toHttp3Headers() in the netty-codec-http3 module, which processes HTTP/1 requests for conversion to HTTP/3. When an absolute-form HTTP/1 request-target contains its own authority, the code incorrectly prioritizes a conflicting Host header before deriving the :authority pseudo-header from the request-target URI, violating RFC 9112. This affects HTTP/1-to-HTTP/3 gateways and proxies with no authentication required; an unauthenticated remote attacker can trigger authority confusion that causes upstream HTTP/3 services to make security decisions based on the attacker-supplied Host header rather than the authoritative request-target.

Affected products

Netty Project netty-codec-http3 4.2.2.Final through 4.2.17.Final

Timeline

2026-09-26: disclosed
2026-09-26: patched: Fixed in 4.2.18.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.