CVE-2026-100659 Overview
CVE-2026-100659 is an HTTP Request Smuggling vulnerability [CWE-444] in Netty's HTTP/3 codec (io.netty:netty-codec-http3). Affected versions 4.2.0.Final through 4.2.17.Final fail to enforce an RFC 9114 requirement that the :authority pseudo-header and a literal host header must carry the same value when both are present. A remote unauthenticated attacker can send a single HEADERS frame containing both fields with differing, attacker-controlled values. The request is accepted and delivered to the application with two conflicting authorities. This allows routing, virtual-host, and access-control decisions to be bypassed when downstream components consult different fields. The issue is fixed in version 4.2.18.Final.
Critical Impact
Attackers can bypass virtual-host routing and access-control checks by sending HTTP/3 requests with mismatched :authority and host header values.
Affected Products
- Netty io.netty:netty-codec-http3 version 4.2.0.Final
- Netty io.netty:netty-codec-http3 versions 4.2.1.Final through 4.2.17.Final
- Applications and gateways built on Netty's HTTP/3 stack within the affected version range
Discovery Timeline
- 2026-09-26 - CVE-2026-100659 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-100659
Vulnerability Analysis
The flaw sits in Netty's HTTP/3 header processing path. RFC 9114 requires that if a client sends both the :authority pseudo-header and a literal host header in a single HEADERS frame, the two fields must contain identical values. The codec in affected versions does not validate this invariant. The request is parsed, passed through the pipeline, and surfaced to upstream handlers with two conflicting authority values intact.
The practical impact depends on how downstream components resolve authority. Reverse proxies, routing layers, and virtual-host dispatchers frequently consult :authority, while application code and access-control filters may read the Host header. When these components disagree, an attacker can smuggle traffic to one virtual host while access checks evaluate another. This creates a classic desync that undermines tenant isolation and host-based authorization.
Root Cause
The root cause is missing input validation in the HTTP/3 codec's header-decoding stage. The implementation accepts both fields without comparing their values or rejecting the request when they diverge, in violation of RFC 9114 \u00a74.3.1.
Attack Vector
Exploitation requires only network reachability to an HTTP/3 endpoint powered by an affected Netty release. The attacker crafts a QUIC-transported HEADERS frame containing a :authority value pointing at the intended internal target and a Host header pointing at a host the attacker is authorized to reach, or vice versa. No authentication or user interaction is required. See the GitHub Security Advisory GHSA-q9pg-8h3j-8hvm and the VulnCheck Advisory for Netty Bypass for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-100659
Indicators of Compromise
- HTTP/3 requests where the :authority pseudo-header and Host header carry different values at the same ingress point.
- Access logs showing requests reaching internal virtual hosts that should not be externally addressable.
- Unexpected routing decisions or 200-response codes on paths normally gated by host-based access control.
Detection Strategies
- Inventory services for the Netty netty-codec-http3 dependency and flag any instance in the 4.2.0.Final through 4.2.17.Final range.
- Instrument HTTP/3 ingress to log both :authority and Host values and alert when they diverge.
- Replay suspect traffic captures through a parser that enforces RFC 9114 \u00a74.3.1 to identify historical exploitation attempts.
Monitoring Recommendations
- Forward HTTP/3 ingress logs, including authority metadata, to a centralized analytics platform for correlation with routing outcomes.
- Baseline per-tenant authority values and alert on deviations between proxy-observed and application-observed hostnames.
- Monitor Software Composition Analysis (SCA) output for the vulnerable Netty coordinate across build pipelines.
How to Mitigate CVE-2026-100659
Immediate Actions Required
- Upgrade io.netty:netty-codec-http3 to version 4.2.18.Final or later across all services and container images.
- Audit reverse proxies and gateways in front of HTTP/3 endpoints to confirm consistent authority handling.
- Rebuild and redeploy applications that transitively depend on the vulnerable Netty coordinate.
Patch Information
The maintainers resolved the issue in Netty 4.2.18.Final by enforcing the RFC 9114 requirement that :authority and Host must match when both are present. Refer to the GitHub Security Advisory GHSA-q9pg-8h3j-8hvm for the authoritative fix reference and backport guidance.
Workarounds
- Place a validating HTTP/3-aware proxy in front of Netty that rejects requests when :authority and Host differ.
- Normalize authority handling in application code so that only one of the two fields is trusted for routing and access control.
- Disable HTTP/3 listeners temporarily if upgrading is not immediately possible and HTTP/2 or HTTP/1.1 fallbacks are acceptable.
# Maven dependency pin to the fixed release
# <dependency>
# <groupId>io.netty</groupId>
# <artifactId>netty-codec-http3</artifactId>
# <version>4.2.18.Final</version>
# </dependency>
# Gradle equivalent
# implementation("io.netty:netty-codec-http3:4.2.18.Final")
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
