Executive brief
Netty is a popular framework used by developers to build high-performance network applications and servers. A vulnerability in its HTTP/3 component allows a remote attacker to crash the application by sending an excessive amount of header data. This results in a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.
Technical details
The vulnerability exists in the Netty HTTP/3 codec due to an insecure default configuration in the `Http3ConnectionHandler`. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit, deviating from the secure-by-default 8192-byte limit Netty applies to HTTP/1.1 and HTTP/2. An unauthenticated remote attacker can exploit this by sending an enormous number of headers, leading to an `OutOfMemoryError` and application crash. The issue is rooted in `Http3FrameCodec` where the `maxHeaderListSize` is initialized without a safe upper bound. This is addressed in version 4.2.15.Final by enforcing a default limit.
Affected products
- Netty netty-codec-http3 >= 4.2.0.Final, <= 4.2.14.Final
Timeline
- 2026-06-02: patched: Release of version 4.2.15.Final
- 2026-06-05: advisory: GitHub Security Advisory GHSA-c2rx-5r8w-8xr2 published
- 2026-06-12: disclosed: CVE published to NVD