CVE-2026-100660: Netty HTTP/3 Codec DOS Vulnerability

CVE-2026-100660 Overview

CVE-2026-100660 is a denial-of-service vulnerability in Netty's HTTP/3 codec (io.netty:netty-codec-http3) affecting versions 4.2.0.Final through 4.2.17.Final. The flaw resides in QpackEncoder, which retains per-stream QPACK (QUIC Header Compression) encoder state without any upper bound. A remote, unauthenticated HTTP/3 client can withhold mandatory Section Acknowledgments while issuing sequential requests, forcing the server to accumulate heap state until memory is exhausted. The issue is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling] and resolved in 4.2.18.Final.

Critical Impact
Unauthenticated attackers can trigger unbounded heap growth over a single QUIC connection, exhausting server memory and causing availability loss.

Affected Products

Netty io.netty:netty-codec-http34.2.0.Final through 4.2.17.Final
Any application or service embedding the affected Netty HTTP/3 codec
Fixed in Netty 4.2.18.Final

Discovery Timeline

2026-09-26 - CVE-2026-100660 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100660

Vulnerability Analysis

The vulnerability lives in Netty's QpackEncoder implementation of HTTP/3 header compression. For every encoded field section that references the QPACK dynamic table, the encoder stores a queue and a dynamic-table index tracker. Each entry is keyed by the peer-controlled QUIC stream ID.

These tracking structures are only released when the remote decoder sends a Section Acknowledgment or Stream Cancellation instruction over the QPACK decoder stream. They are not released when the HTTP/3 request stream terminates. The codec applies no limit to the number of tracked streams, retained field sections, or total retained bytes.

An attacker exploits this behavior by advertising a non-zero QPACK dynamic-table capacity, acknowledging an initial table insertion so the server reuses a dynamically indexed response header, and then suppressing all subsequent Section Acknowledgments while issuing sequential requests. Because streams open and close normally, QUIC concurrent-stream limits are bypassed and server heap usage grows without bound.

Root Cause

The root cause is missing resource accounting in QpackEncoder. Per-stream encoder tracking state is tied to peer-controlled acknowledgment signals rather than stream lifecycle, and no ceiling is enforced on tracked streams, outstanding field sections, or retained byte count.

Attack Vector

Exploitation requires only network reachability to an HTTP/3 endpoint built on vulnerable Netty versions. No authentication or user interaction is needed. A single long-lived QUIC connection is sufficient to drive the server to out-of-memory conditions.

No verified public exploitation code is available. See the GitHub Security Advisory GHSA-495p-pchh-r4mc and the VulnCheck Netty Advisory for additional technical context.

Detection Methods for CVE-2026-100660

Indicators of Compromise

Sustained heap growth in Java processes hosting Netty HTTP/3 endpoints, culminating in OutOfMemoryError events in application logs.
Long-lived QUIC connections issuing many sequential HTTP/3 requests without emitting QPACK Section Acknowledgment frames on the decoder stream.
Elevated instance counts of QPACK encoder tracking objects visible in heap dumps keyed by QUIC stream ID.

Detection Strategies

Instrument JVM metrics (heap usage, old-generation growth, GC frequency) on all services exposing HTTP/3 and alert on anomalous growth tied to specific client connections.
Inspect QUIC/HTTP/3 telemetry for connections with high request volume and an absent or disproportionately low ratio of QPACK Section Acknowledgment frames.
Correlate netty-codec-http3 version information from software bill of materials data to identify exposed services running 4.2.0.Final through 4.2.17.Final.

Monitoring Recommendations

Enable per-connection and per-stream resource accounting at the application layer where available, and log anomalies for review.
Forward JVM heap and GC metrics along with HTTP/3 server access logs into a centralized analytics platform for correlation.
Track dependency inventories continuously to flag any reintroduction of vulnerable Netty HTTP/3 codec versions.

How to Mitigate CVE-2026-100660

Immediate Actions Required

Upgrade io.netty:netty-codec-http3 to 4.2.18.Final or later across all services and container images.
Audit build manifests (Maven, Gradle, SBOMs) for transitive dependencies pulling vulnerable Netty HTTP/3 codec versions.
Restart affected services after upgrading to clear any accumulated encoder state.

Patch Information

The Netty maintainers fixed the issue in 4.2.18.Final by bounding QPACK encoder tracking state. Operators should pin the dependency to 4.2.18.Final or later. Refer to the GitHub Security Advisory GHSA-495p-pchh-r4mc for the authoritative fix reference.

Workarounds

Disable the HTTP/3 listener on affected services until the upgrade is deployed, forcing clients to fall back to HTTP/2 or HTTP/1.1.
Configure the QPACK dynamic-table capacity advertised by the server to zero so that dynamic indexing, and the associated tracking state, is not used.
Terminate QUIC connections at an upstream proxy or load balancer that enforces per-connection memory and request-rate limits.

bash

# Maven dependency pin example
# <dependency>
#   <groupId>io.netty</groupId>
#   <artifactId>netty-codec-http3</artifactId>
#   <version>4.2.18.Final</version>
# </dependency>
mvn dependency:tree | grep netty-codec-http3