CVE-2026-100664
Received Received - Intake

Netty HTTP/3 Authority Confusion via Host Header

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge, a remote client can send a request such as "GET https://trusted.example/admin HTTP/1.1" with "Host: attacker.example", causing components that validate, authorize, or route on the RFC-defined request-target authority to reach a different decision than the upstream HTTP/3 peer, which receives :authority derived from the conflicting Host header. This authority confusion can affect virtual-host routing, allow-list checks, backend selection, cache keys, and URL generation. The advisory reports integrity impact only (no code execution, memory corruption, or availability impact). Fixed in 4.2.18.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100664
EUVD
EUVD-2026-87758

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
netty netty_codec_http3 From 4.2.2.Final (inc) to 4.2.17.Final (inc)
netty netty_codec_http3 4.2.18.Final
netty netty-codec-http3 From 4.2.2.Final (inc) to 4.2.17.Final (inc)
netty netty-codec-http3 4.2.18.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Netty's HTTP/3 codec (versions 4.2.2.Final to 4.2.17.Final) where the Host header in an HTTP/1 absolute-form request incorrectly overrides the authority specified in the request-target during HTTP/1-to-HTTP/3 conversion. This causes the HTTP/3 request to use the Host header's authority instead of the intended request-target authority, leading to authority confusion.

Detection Guidance

To detect this vulnerability, inspect network traffic for HTTP/1 absolute-form requests with mismatched Host headers and HTTP/3 requests. Check Netty versions in use; versions 4.2.2.Final through 4.2.17.Final are vulnerable. Monitor for unexpected routing, backend selection, or cache key mismatches in HTTP/1-to-HTTP/3 gateways.

Impact Analysis

This vulnerability can impact integrity by causing incorrect routing, authorization, or security decisions in HTTP/1-to-HTTP/3 gateways or proxies. It may lead to backend selection errors, virtual-host routing issues, allow-list bypasses, cache key mismatches, and incorrect URL generation.

Compliance Impact

This vulnerability primarily affects integrity, which could lead to unauthorized access or data breaches if routing or authorization decisions are manipulated. Compliance with GDPR or HIPAA may be impacted if such breaches occur, as unauthorized access to sensitive data could violate regulatory requirements.

Mitigation Strategies

Upgrade Netty to version 4.2.18.Final or later to fix the issue. If upgrading is not immediately possible, review and adjust gateway configurations to validate Host headers against request-target authorities. Implement strict input validation for HTTP/1 absolute-form requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart