# CVE-2026-100664: Netty HTTP/3 codec Host header authority confusion

Source: https://junglewise.ai/threats/cve-2026-100664-netty-s-http-3-codec-io-netty-netty-codec-http3-versions-4-2-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100664 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty's HTTP/3 library incorrectly prioritizes the HTTP/1 Host header over the request URL when converting HTTP/1 requests to HTTP/3, which could trick intermediary gateways or proxies into routing traffic to an attacker-controlled destination. In an HTTP/1-to-HTTP/3 gateway or proxy, an attacker can send a request to one domain in the URL but specify a different domain in the Host header, causing the upstream HTTP/3 service to use the wrong destination. This can bypass virtual-host routing, allowlist checks, and other security controls that rely on the correct authority.

Technologies: [Netty Project Netty-Codec-Http3](https://junglewise.ai/threats/technologies/codec-http3). Vendors: [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-100664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100664 being exploited in the wild.

**How severe is CVE-2026-100664?** High severity, with a CVSS score of 7.5, published 26 September 2026.

**Which products and versions are affected?** Netty Project Netty-Codec-Http3 4.2.2.Final through 4.2.17.Final.

**Is there a fix for CVE-2026-100664?** A patch was published on 2026-09-26: Fixed in 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100664 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100664?** Check whether you run Netty Project Netty-Codec-Http3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in HttpConversionUtil.toHttp3Headers() in the netty-codec-http3 module, which processes HTTP/1 requests for conversion to HTTP/3. When an absolute-form HTTP/1 request-target contains its own authority, the code incorrectly prioritizes a conflicting Host header before deriving the :authority pseudo-header from the request-target URI, violating RFC 9112. This affects HTTP/1-to-HTTP/3 gateways and proxies with no authentication required; an unauthenticated remote attacker can trigger authority confusion that causes upstream HTTP/3 services to make security decisions based on the attacker-supplied Host header rather than the authoritative request-target.

## Affected products

- Netty Project netty-codec-http3 4.2.2.Final through 4.2.17.Final

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in 4.2.18.Final

## References

- [https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h](https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h)
- [https://www.vulncheck.com/advisories/netty-4.2.2-through-4.2.15-http-1-host-header-authority-confusion](https://www.vulncheck.com/advisories/netty-4.2.2-through-4.2.15-http-1-host-header-authority-confusion)

## Related threats

- [Netty HTTP/3 codec host header validation bypass](https://junglewise.ai/threats/cve-2026-100659-netty-s-http-3-codec-io-netty-netty-codec-http3-in-versions-4-2)