Executive brief
Netty is a popular networking framework used by many Java applications to handle web traffic. A vulnerability in its HTTP/3 implementation allows a remote attacker to send a specially crafted message that forces the server to allocate massive amounts of memory. This can lead to significant performance slowdowns, service instability, or a complete server crash, potentially disrupting business operations.
Technical details
A vulnerability exists in the QpackDecoder of Netty's HTTP/3 codec due to improper validation of literal lengths. Specifically, in the non-Huffman branch of decodeHuffmanEncodedLiteral, the decoder performs a byte array allocation based on a length value provided directly from the network wire before verifying if that many bytes are actually available in the buffer. An attacker can exploit this by sending a small, malicious HTTP/3 HEADERS frame that specifies a very large length (e.g., 1GB), leading to excessive memory allocation (CWE-770, CWE-789). This can result in an OutOfMemoryError or IndexOutOfBoundsException, causing a denial of service. The issue is fixed in version 4.2.13.Final.
Affected products
- Netty netty-codec-http3 >= 4.2.0.Final, <= 4.2.12.Final
Timeline
- 2026-05-05: disclosed: Vulnerability disclosed by chrisvest
- 2026-05-07: advisory: GitHub Advisory GHSA-2c5c-chwr-9hqw published
- 2026-05-13: other: Published to the National Vulnerability Database (NVD)
- 2026-06-30: other: Advisory last updated