CVE-2026-100662— Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
Quick assessment
Affected
netty netty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Netty 的 HTTP/3 编解码器（io.netty:netty-codec-http3）在版本 4.2.0.Final 至 4.2.17.Final 中存在一个非受控资源消耗漏洞，该漏洞位于 QPACK 编码器流指令解码器（QpackEncoderHandler）中。该处理程序安装在由对端发起的、类型为 0x02 的单向 QPACK 编码器流上。 此处理程序接受攻击者声明的字符串字面量长度，上限可达 Integer.MAX_VALUE（约 2 GiB），用于 “带字面量名称的插入”（Insert With L
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1498 · Network Denial of Service T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100662
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the "Insert With Literal Name" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100662
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100662
请登录查看更多情报信息。
Other References for CVE-2026-100662 (1)
Other References for CVE-2026-100662 (1)
Same Patch Batch · netty · 2026-09-26 · 12 CVEs total
| CVE-2026-100655 | 7.5 HIGH | Netty before 4.1.138.Final Denial of Service via SpdySessionHandler |
| CVE-2026-100663 | 7.5 HIGH | Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 |
| CVE-2026-100656 | 7.5 HIGH | Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining |
| CVE-2026-100661 | 7.5 HIGH | Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation |
| CVE-2026-100660 | 7.5 HIGH | Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention |
| CVE-2026-100665 | 7.5 HIGH | Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass |
| CVE-2026-100664 | 7.5 HIGH | Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion |
| CVE-2026-100657 | 7.5 HIGH | Netty before 4.1.138.Final ByteBuf Leak in StompSubframeDecoder |
| CVE-2026-100666 | 7.3 HIGH | Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec |
| CVE-2026-100659 | 6.5 MEDIUM | Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass |
| CVE-2026-100658 | 5.3 MEDIUM | Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler |
IV. Related Vulnerabilities
Same product: netty
-
CVE-2026-100666
Netty 4.2.0 through 4.2.16 Response Desynchronization via Ht -
CVE-2026-100665
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypas -
CVE-2026-100664
Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Conf -
CVE-2026-100663
Netty HTTP/1 CONNECT authority-form mistranslated to malform -
CVE-2026-100660
Netty before 4.2.18.Final QpackEncoder Unbounded Memory Rete
Same vendor: netty
-
CVE-2026-100666
Netty 4.2.0 through 4.2.16 Response Desynchronization via Ht -
CVE-2026-100665
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypas -
CVE-2026-100663
Netty HTTP/1 CONNECT authority-form mistranslated to malform -
CVE-2026-100664
Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Conf -
CVE-2026-100660
Netty before 4.2.18.Final QpackEncoder Unbounded Memory Rete
Same weakness: CWE-400
-
CVE-2026-94408
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94397
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94396
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94400
Uncontrolled Resource Consumption in Kibana Leading to denia -
CVE-2026-94399
Uncontrolled Resource Consumption in Elasticsearch Leading t
V. Comments for CVE-2026-100662
No comments yet