Netty QpackEncoder Unbounded Heap Retention Vulnerability Analysis

Netty QPACK Encoder Memory Leak Vulnerability Summary Vulnerability Overview Vulnerability Name: QpackEncoder retains unbounded per-stream dynamic-table trackers when a peer withholds Section Acknowledgments Vulnerability Type: Resource Exhaustion / Memory Leak (Unbounded Heap Retention) Severity: High (CVSS 7.5) Description: Netty's HTTP/3 retains a queue and a dynamic table index tracker for each encoded field part. These objects are only removed upon receiving control instructions from the remote decoder (such as or ). If a malicious client intentionally omits sending acknowledgment instructions, these trackers will be retained indefinitely, leading to server memory exhaustion. Affected Scope Affected Component: Affected Versions: , Attack Conditions: The attacker only needs to maintain a single long-lived QUIC connection and send a large number of requests containing repetitive, non-sensitive response headers (such as ), while intentionally withholding Section Acknowledgments. Remediation Fixed Version: and later versions. POC Code A complete PoC code is provided below to demonstrate this vulnerability. The code utilizes the version from Maven Central to simulate malicious client behavior: ```java package io.netty.handler.codec; import io.netty.buffer.ByteBuf; import io.netty.buffer.UnpooledByteBufAllocator; import io.netty.handler.codec.http3.Http3FrameCodec; import io.netty.handler.codec.http3.QpackDecoder; import io.netty.handler.codec.http3.QpackEncoder; import io.netty.handler.codec.http3.QpackSensitivityDetector; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.NEVER_SENSITIVE; import io.netty.handler.codec.http3.QpackSensitivityDetector.ALWAYS_SENSITIV

Goal Reached Thanks to every supporter — we hit 100%!

Netty QpackEncoder Unbounded Heap Retention Vulnerability Analysis

More from this source