Executive brief
A vulnerability in the Netty networking library's HTTP/3 implementation can allow an attacker to crash a server by exhausting its memory. By sending specifically crafted requests that trigger a flaw in how the server manages data streams, an attacker can force the application to consume all available memory, leading to a complete service outage. This affects any application using Netty's HTTP/3 codec with dynamic tables enabled.
Technical details
A resource exhaustion vulnerability exists in Netty's `QpackDecoder` due to an improper boundary check in the `shouldWaitForDynamicTableUpdates` method. When `HTTP3_SETTINGS_QPACK_MAX_TABLE_CAPACITY` is enabled but `HTTP3_SETTINGS_QPACK_BLOCKED_STREAMS` is left at its default of 0, a logic error (`blockedStreamsCount == -1`) allows the limit on blocked streams to be bypassed. An attacker can exploit this by sending headers referencing missing table entries, creating an unlimited number of blocked streams that are never removed from memory. This leads to a Java Virtual Machine (JVM) Out of Memory (OOM) error and a Denial of Service (DoS). The issue is fixed in version 4.2.15.Final.
Affected products
- Netty netty-codec-http3 >= 4.2.0.Final, <= 4.2.13.Final
Timeline
- 2026-06-05: disclosed: Initial disclosure on GitHub
- 2026-06-12: advisory: NVD publication date
- 2026-06-15: advisory: GitHub Advisory Database publication date