CVE-2026-100661
Received Received - Intake

Denial-of-Service in Netty HTTP/3 Codec

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100661
EUVD
EUVD-2026-87755

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netty netty_codec_http3 From 4.2.0.Final (inc) to 4.2.17.Final (inc)
netty netty_codec_http3 4.2.18.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in Netty's HTTP/3 codec affecting versions 4.2.0.Final through 4.2.17.Final. It involves a flaw in the QPACK prefixed-integer decoder that fails to limit continuation bytes. An attacker can send a specially crafted QPACK stream with an unterminated integer, causing the decoder to repeatedly request more bytes without consuming data. This leads to unbounded heap growth and O(N^2) CPU usage per decode attempt.

Detection Guidance

To detect this vulnerability, monitor for unusual network traffic patterns involving HTTP/3 QPACK streams. Check for connections with excessive CPU usage or memory consumption on Netty servers running versions 4.2.0.Final to 4.2.17.Final. Inspect logs for OutOfMemoryError exceptions or event-loop starvation events.

Impact Analysis

This vulnerability can cause severe service disruption. It allows remote attackers to exhaust server memory (OutOfMemoryError) and starve CPU resources by sending malicious QPACK streams. The attack requires no authentication, user interaction, or special privileges, making it accessible to any remote peer. Systems using vulnerable Netty versions may experience crashes or become unresponsive.

Mitigation Strategies

Upgrade Netty to version 4.2.18.Final or later immediately. If upgrading is not possible, disable HTTP/3 support or apply network-level mitigations such as rate limiting or blocking QPACK unidirectional streams.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100661. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart