CVE-2026-100661: Netty HTTP/3 Codec DOS Vulnerability

CVE-2026-100661 Overview

CVE-2026-100661 is a denial-of-service vulnerability in Netty's HTTP/3 codec (io.netty:netty-codec-http3), affecting versions 4.2.0.Final through 4.2.17.Final. The flaw resides in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which fails to bound the number of continuation bytes it processes. A remote, unauthenticated attacker can open a QPACK unidirectional stream and send crafted bytes that force unbounded buffer accumulation and O(N²) decode work. The condition is reachable in every configuration and is fixed in 4.2.18.Final. The weakness is classified as uncontrolled resource consumption [CWE-400].

Critical Impact
A single unauthenticated peer can trigger unbounded per-connection heap growth leading to OutOfMemoryError and event-loop CPU starvation across any Netty HTTP/3 server.

Affected Products

Netty io.netty:netty-codec-http3 version 4.2.0.Final
Netty io.netty:netty-codec-http3 versions 4.2.1.Final through 4.2.17.Final
Any application or framework embedding the vulnerable HTTP/3 codec on the server or client side

Discovery Timeline

2026-09-26 - CVE-2026-100661 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100661

Vulnerability Analysis

QPACK, the header compression format used by HTTP/3, encodes integers using a prefix-and-continuation scheme similar to HPACK. When a value does not fit in the available prefix bits, the encoder emits a run of continuation bytes with the high bit set until a terminating byte with the high bit cleared appears. Netty's QpackUtil.decodePrefixedInteger reads continuation bytes without enforcing an upper bound.

When the decoder cannot find a terminating byte in the current buffer, it returns -1 to signal "need more bytes." The ByteToMessageDecoder cumulator then preserves the unconsumed input and appends further bytes received from the stream. Every subsequent decode() invocation re-scans the entire accumulated buffer, producing quadratic CPU cost relative to the attacker-supplied byte count.

Root Cause

The root cause is missing input bounds in QpackUtil.decodePrefixedInteger. The function trusts the peer to eventually terminate the continuation sequence. Combined with the stateful cumulator behavior of ByteToMessageDecoder, this trust turns a protocol parser into an uncontrolled resource consumer. The result is both memory exhaustion (OutOfMemoryError) and starvation of the Netty event loop.

Attack Vector

Exploitation requires only network reach to an HTTP/3 endpoint. A remote, unauthenticated peer opens a QPACK unidirectional stream of type 0x02 (encoder) or 0x03 (decoder). The attacker then sends a first byte with all prefix bits set, such as 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix, followed by an endless stream of 0x80 continuation bytes. Because no terminating byte ever arrives, the decoder never completes, the cumulator grows unbounded, and every new chunk triggers a full re-scan. A single connection is sufficient to degrade or crash the target process.

Detection Methods for CVE-2026-100661

Indicators of Compromise

Sustained inbound QUIC streams of unidirectional type 0x02 or 0x03 carrying long runs of 0x80 bytes without a terminating byte.
JVM processes hosting Netty HTTP/3 showing rapid heap growth, frequent full GCs, and eventual java.lang.OutOfMemoryError entries in logs.
Netty event-loop threads pinned at 100% CPU while per-connection byte accumulation metrics climb linearly.

Detection Strategies

Inventory JVM applications and container images for io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final using software composition analysis.
Instrument Netty pipelines with handlers that cap ByteToMessageDecoder cumulator size and emit telemetry when a QPACK stream exceeds a reasonable byte threshold.
Correlate QUIC traffic volume per source address with target heap and CPU metrics to flag single-source resource exhaustion.

Monitoring Recommendations

Alert on OutOfMemoryError and sustained GC pause spikes on hosts exposing HTTP/3 listeners.
Track per-connection bytes-in-flight and stream duration on QUIC endpoints to surface slow or non-terminating QPACK streams.
Forward JVM, QUIC, and reverse-proxy logs into a central analytics platform so resource-exhaustion patterns can be queried across the fleet.

How to Mitigate CVE-2026-100661

Immediate Actions Required

Upgrade io.netty:netty-codec-http3 to 4.2.18.Final or later across all build pipelines and runtime images.
Rebuild and redeploy downstream frameworks and services that bundle the Netty HTTP/3 codec as a transitive dependency.
Where upgrade is blocked, disable HTTP/3 listeners or front them with a QUIC-aware proxy that enforces strict stream and byte limits.

Patch Information

The maintainers fixed the issue in Netty 4.2.18.Final by bounding the number of continuation bytes QpackUtil.decodePrefixedInteger will process and failing the stream when the limit is exceeded. See the Netty GitHub Security Advisory GHSA-v5p2-hmgx-3xrx and the VulnCheck Security Advisory for additional technical context.

Workarounds

Terminate HTTP/3 at an upstream load balancer or CDN that enforces QUIC stream byte limits and idle-stream timeouts.
Add a custom Netty handler ahead of the QPACK decoder that fails any unidirectional stream exceeding a conservative byte ceiling.
Restrict HTTP/3 exposure to trusted networks until the patched release is deployed.

bash

# Maven dependency pin to the patched release
# pom.xml
# <dependency>
#   <groupId>io.netty</groupId>
#   <artifactId>netty-codec-http3</artifactId>
#   <version>4.2.18.Final</version>
# </dependency>

mvn dependency:tree -Dincludes=io.netty:netty-codec-http3
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.2.18.Final