CVE-2026-100663
Received Received - Intake

HTTP/3 CONNECT Authority Spoofing in Netty

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., "CONNECT trusted.example:443") is parsed as a URI, so its host is emitted as :scheme, :path is set to "/", and the HTTP/1 Host header is used as :authority; if no Host header is present the CONNECT target is dropped. In a Netty-based HTTP/1-to-HTTP/3 proxy or gateway, a remote client can send a CONNECT request whose Host header names a different authority than the request-target, producing a malformed HTTP/3 CONNECT whose tunnel :authority is attacker-controlled. This can bypass tunnel allow-lists, egress policy, backend selection, or audit controls that validate the HTTP/1 CONNECT request-target before forwarding over HTTP/3. The issue is fixed in 4.2.18.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100663
EUVD
EUVD-2026-87757

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
netty netty-codec-http3 From 4.2.2.Final (inc) to 4.2.17.Final (inc)
netty netty-codec-http3 4.2.18.Final
netty netty_codec_http3 From 4.2.2.Final (inc) to 4.2.17.Final (inc)
netty netty_codec_http3 4.2.18.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Netty's HTTP/3 codec when converting HTTP/1 CONNECT requests to HTTP/3. The issue occurs because the conversion logic does not properly handle the CONNECT authority-form request-target. Instead of correctly mapping the target authority to the HTTP/3 :authority pseudo-header, it incorrectly parses the target as a URI, leading to a malformed HTTP/3 CONNECT request where an attacker can control the tunnel destination by manipulating the Host header.

Detection Guidance

To detect this vulnerability, check if your system uses Netty versions 4.2.2.Final through 4.2.17.Final. Inspect the Netty library version in your application dependencies or runtime environment. Look for HTTP/1-to-HTTP/3 proxy or gateway configurations, as these are affected by the issue.

Impact Analysis

If you use a Netty-based HTTP/1-to-HTTP/3 proxy or gateway running versions 4.2.2.Final through 4.2.17.Final, an attacker could bypass security controls like allow-lists or egress policies. This could allow unauthorized connections to restricted systems or data exfiltration through manipulated tunnels.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality and integrity requirements in GDPR and HIPAA. Bypassing allow-lists or audit controls may result in non-compliance with data protection and access control mandates.

Mitigation Strategies

Upgrade Netty to version 4.2.18.Final or later to patch the vulnerability. If upgrading is not immediately possible, disable HTTP/3 support or HTTP/1-to-HTTP/3 conversion in your Netty-based proxy or gateway until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart