CVE-2026-100660
Received Received - Intake

Memory Exhaustion in Netty HTTP/3 Codec via Unbounded QPACK State

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controlled QUIC stream ID, and these entries are released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation instruction — not when the HTTP/3 stream completes. There is no limit on the number of tracked streams, field sections, or retained bytes. A remote, unauthenticated HTTP/3 client can advertise a non-zero QPACK dynamic-table capacity, acknowledge the table insertion so the server reuses a dynamically indexed response header, and then omit all mandatory Section Acknowledgments while issuing sequential requests over a single QUIC connection, bypassing concurrent-stream limits and causing unbounded heap growth until the server exhausts memory (denial of service). Fixed in 4.2.18.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100660
EUVD
EUVD-2026-87754

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
netty netty-codec-http3 From 4.2.0.Final (inc) to 4.2.17.Final (inc)
netty netty-codec-http3 4.2.18.Final
netty netty_codec_http3 From 4.2.0.Final (inc) to 4.2.17.Final (inc)
netty netty_codec_http3 4.2.18.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Netty's HTTP/3 codec (io.netty:netty-codec-http3) from versions 4.2.0.Final to 4.2.17.Final involves unbounded memory retention in the QpackEncoder component. The QpackEncoder stores per-stream QPACK encoder state, including queues and dynamic-table index trackers, for every encoded field section referencing the QPACK dynamic table. These entries are only released when the remote decoder sends a Section Acknowledgment or Stream Cancellation instruction, not when the HTTP/3 stream completes. This allows an unauthenticated remote HTTP/3 client to exploit the issue by advertising a non-zero QPACK dynamic-table capacity, acknowledging table insertions, and omitting required Section Acknowledgments while sending sequential requests. This bypasses concurrent-stream limits, causing unbounded heap growth and eventually exhausting server memory, leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for unbounded memory growth in Netty HTTP/3 applications. Check for excessive heap usage in Java processes running Netty versions 4.2.0.Final to 4.2.17.Final. Use commands like 'jcmd <pid> VM.native_memory' to inspect native memory usage or 'jstat -gc <pid>' to monitor garbage collection pressure. Network monitoring can identify HTTP/3 traffic patterns with many sequential requests lacking Section Acknowledgments.

Impact Analysis

This vulnerability can lead to denial of service by exhausting server memory. An unauthenticated remote attacker can exploit it to cause excessive garbage-collection pressure, trigger OutOfMemoryError, or crash the server by retaining unbounded memory for QPACK encoder state. The attack does not require many active streams, malformed frames, or high bandwidth, making it efficient and stealthy.

Mitigation Strategies

Upgrade Netty to version 4.2.18.Final or later immediately. If upgrading is not possible, disable HTTP/3 support in Netty applications or restrict HTTP/3 traffic at the network level. Monitor memory usage closely and implement rate limiting for HTTP/3 connections to prevent abuse.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100660. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart