Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100659— Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Quick assessment

Affected
netty netty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Netty 版本 4.2.0.Final 至 4.2.17.Final 中，其 HTTP/3 编解码器（io.netty:netty-codec-http3）未强制执行 RFC 9114 的要求：当 :authority 伪头字段与字面意义上的 host 头字段同时存在时，二者必须具有相同的值。远程未认证的对等方可以发送一个包含这两个字段且值不同（由攻击者控制）的 HEADERS 帧；该请求会被接受并传递给应用程序，导致请求中出现两个相互冲突的 authority 值。当请求路径中的不同组件分别检查这些字段时，

CVSS 6.5 · Medium EPSS 0.24% · P13
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100659

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single HEADERS frame containing both fields with differing, attacker-controlled values; the request is accepted and delivered to the application with two conflicting authorities, allowing routing, virtual-host, and access-control decisions to be bypassed when different components in the request path consult different fields. This issue is fixed in 4.2.18.Final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
netty netty 4.2.0.Final ~ 4.2.18.Final -

II. Public POCs for CVE-2026-100659

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100659

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100659 (1)

Other References for CVE-2026-100659 (1)

Same Patch Batch · netty · 2026-09-26 · 12 CVEs total

CVE-2026-100655 7.5 HIGH Netty before 4.1.138.Final Denial of Service via SpdySessionHandler
CVE-2026-100663 7.5 HIGH Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3
CVE-2026-100656 7.5 HIGH Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining
CVE-2026-100661 7.5 HIGH Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
CVE-2026-100660 7.5 HIGH Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
CVE-2026-100665 7.5 HIGH Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
CVE-2026-100662 7.5 HIGH Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
CVE-2026-100664 7.5 HIGH Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
CVE-2026-100657 7.5 HIGH Netty before 4.1.138.Final ByteBuf Leak in StompSubframeDecoder
CVE-2026-100666 7.3 HIGH Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
CVE-2026-100658 5.3 MEDIUM Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler

IV. Related Vulnerabilities

Same product: netty
Same vendor: netty
Same weakness: CWE-444

V. Comments for CVE-2026-100659

No comments yet

Leave a comment