CVE-2026-100664— Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
Quick assessment
Affected
netty netty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述信息的中文翻译： Netty 的 HTTP/3 编解码器（io.netty:netty-codec-http3）在 4.2.2.Final 至 4.2.17.Final 版本中，在考虑绝对形式 HTTP/1 请求目标的授权（authority）之前，会从 HTTP/1 的 Host 头部构建 HTTP/3 的 :authority 伪头部。在 HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) 方法中（通过 Http3FrameToHttp
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100664
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
Source: CVE Program / CVE List V5
Vulnerability Description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge, a remote client can send a request such as "GET https://trusted.example/admin HTTP/1.1" with "Host: attacker.example", causing components that validate, authorize, or route on the RFC-defined request-target authority to reach a different decision than the upstream HTTP/3 peer, which receives :authority derived from the conflicting Host header. This authority confusion can affect virtual-host routing, allow-list checks, backend selection, cache keys, and URL generation. The advisory reports integrity impact only (no code execution, memory corruption, or availability impact). Fixed in 4.2.18.Final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100664
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100664
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100664 (1)
Other References for CVE-2026-100664 (1)
Same Patch Batch · netty · 2026-09-26 · 12 CVEs total
| CVE-2026-100655 | 7.5 HIGH | Netty before 4.1.138.Final Denial of Service via SpdySessionHandler |
| CVE-2026-100663 | 7.5 HIGH | Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 |
| CVE-2026-100656 | 7.5 HIGH | Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining |
| CVE-2026-100661 | 7.5 HIGH | Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation |
| CVE-2026-100660 | 7.5 HIGH | Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention |
| CVE-2026-100665 | 7.5 HIGH | Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass |
| CVE-2026-100662 | 7.5 HIGH | Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS |
| CVE-2026-100657 | 7.5 HIGH | Netty before 4.1.138.Final ByteBuf Leak in StompSubframeDecoder |
| CVE-2026-100666 | 7.3 HIGH | Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec |
| CVE-2026-100659 | 6.5 MEDIUM | Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass |
| CVE-2026-100658 | 5.3 MEDIUM | Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler |
IV. Related Vulnerabilities
Same product: netty
-
CVE-2026-100666
Netty 4.2.0 through 4.2.16 Response Desynchronization via Ht -
CVE-2026-100665
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypas -
CVE-2026-100663
Netty HTTP/1 CONNECT authority-form mistranslated to malform -
CVE-2026-100662
Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustio -
CVE-2026-100660
Netty before 4.2.18.Final QpackEncoder Unbounded Memory Rete
Same vendor: netty
-
CVE-2026-100666
Netty 4.2.0 through 4.2.16 Response Desynchronization via Ht -
CVE-2026-100665
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypas -
CVE-2026-100663
Netty HTTP/1 CONNECT authority-form mistranslated to malform -
CVE-2026-100662
Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustio -
CVE-2026-100660
Netty before 4.2.18.Final QpackEncoder Unbounded Memory Rete
Same weakness: CWE-20
-
CVE-2026-12267
Authenticated PowerShell Injection in DNS Query Resolution P -
CVE-2026-12268
Authenticated PowerShell Injection leads to RCE -
CVE-2026-88771
A remote code execution vulnerability exists due to improper -
CVE-2026-100833
Contrast before 1.23.1 Image Substitution via Policy Generat -
CVE-2026-100699
Nodemailer before 10.0.9 Malformed Envelope Recipient via RF
V. Comments for CVE-2026-100664
No comments yet