Executive brief
Netty's HTTP/3 library incorrectly prioritizes the HTTP/1 Host header over the request URL when converting HTTP/1 requests to HTTP/3, which could trick intermediary gateways or proxies into routing traffic to an attacker-controlled destination. In an HTTP/1-to-HTTP/3 gateway or proxy, an attacker can send a request to one domain in the URL but specify a different domain in the Host header, causing the upstream HTTP/3 service to use the wrong destination. This can bypass virtual-host routing, allowlist checks, and other security controls that rely on the correct authority.
Technical details
The vulnerability exists in HttpConversionUtil.toHttp3Headers() in the netty-codec-http3 module, which processes HTTP/1 requests for conversion to HTTP/3. When an absolute-form HTTP/1 request-target contains its own authority, the code incorrectly prioritizes a conflicting Host header before deriving the :authority pseudo-header from the request-target URI, violating RFC 9112. This affects HTTP/1-to-HTTP/3 gateways and proxies with no authentication required; an unauthenticated remote attacker can trigger authority confusion that causes upstream HTTP/3 services to make security decisions based on the attacker-supplied Host header rather than the authoritative request-target.
Affected products
- Netty Project netty-codec-http3 4.2.2.Final through 4.2.17.Final
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in 4.2.18.Final