CVE-2026-100662: Netty HTTP/3 Codec DOS Vulnerability

CVE-2026-100662 Overview

CVE-2026-100662 is a resource exhaustion vulnerability in Netty's HTTP/3 codec (io.netty:netty-codec-http3) affecting versions 4.2.0.Final through 4.2.17.Final. The flaw resides in the QpackEncoderHandler responsible for decoding QPACK encoder-stream instructions on the peer-initiated unidirectional stream (type 0x02). A remote, unauthenticated attacker with an established HTTP/3 connection can declare a literal length up to Integer.MAX_VALUE (~2 GiB) and then stall delivery, forcing Netty to retain and grow per-connection buffers until an OutOfMemoryError occurs. The issue is tracked under [CWE-400] and is fixed in 4.2.18.Final.

Critical Impact
A single unauthenticated peer can exhaust server heap memory and crash default Netty HTTP/3 deployments through a crafted QPACK encoder-stream instruction.

Affected Products

Netty io.netty:netty-codec-http3 version 4.2.0.Final
Netty io.netty:netty-codec-http3 versions through 4.2.17.Final
Any application embedding a default Netty HTTP/3 server built on affected codec versions

Discovery Timeline

2026-09-26 - CVE-2026-100662 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100662

Vulnerability Analysis

The vulnerability resides in the QPACK encoder-stream instruction decoder installed on the peer-initiated unidirectional QPACK encoder stream (type 0x02). The QpackEncoderHandler parses the "Insert With Literal Name" instruction defined in RFC 9204 §4.3.3. The handler reads the attacker-supplied Name Length and Value Length fields without enforcing an upper bound, accepting values up to Integer.MAX_VALUE.

Existing HTTP/3 safeguards such as maxHeaderListSize, maxUnknownFramePayloadLength, and DEFAULT_MAX_FIELD_SECTION_SIZE are not applied to this code path. The decoder also lacks a per-instruction length cap and a cumulative-size limit across the encoder stream.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] in QpackEncoderHandler. When the handler accepts a very large declared literal length but receives fewer bytes than declared, the ByteToMessageDecoder MERGE cumulator retains partial data and continues to grow the per-connection buffer. The decoder eventually attempts a byte-array allocation sized to the attacker-declared length, triggering heap exhaustion.

Attack Vector

A remote, unauthenticated attacker establishes an HTTP/3 (QUIC) connection to a default Netty HTTP/3 server. The attacker opens a client-initiated unidirectional stream of type 0x02 (QPACK encoder stream) and sends an "Insert With Literal Name" instruction. The instruction declares a Name Length or Value Length approaching Integer.MAX_VALUE, then trickles fewer bytes than declared.

The server-side cumulator buffers the partial data per connection and eventually allocates a multi-gigabyte byte array. A single connection can drive the JVM to OutOfMemoryError, and multiple connections amplify the impact across the process.

No code example is included because the vendor advisory does not publish exploit code. See the GitHub Security Advisory and the VulnCheck Advisory on Netty HTTP for protocol-level details.

Detection Methods for CVE-2026-100662

Indicators of Compromise

Sustained JVM heap growth correlated with inbound HTTP/3 (UDP/QUIC) connections, culminating in java.lang.OutOfMemoryError
Crash dumps or GC logs showing large single byte[] allocations originating from io.netty.handler.codec.ByteToMessageDecoder MERGE cumulation
Stack traces referencing QpackEncoderHandler or QPACK decoding paths at the time of the crash
Unidirectional QUIC streams of type 0x02 carrying "Insert With Literal Name" instructions declaring multi-megabyte or gigabyte literal lengths

Detection Strategies

Inventory applications and container images for io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final using SBOM or dependency scanning tools
Instrument the Netty pipeline to log declared QPACK literal lengths and alert on values exceeding reasonable header-field sizes (for example, >64 KiB)
Monitor QUIC endpoints for peers that open encoder streams and send partial literal bytes without completing the instruction

Monitoring Recommendations

Track per-connection and per-process JVM heap utilization on HTTP/3-exposed services with alerting on rapid growth slopes
Export GC and allocation telemetry (JFR, async-profiler) to a centralized log platform for anomaly identification
Correlate HTTP/3 server crashes with upstream QUIC connection metadata (source IP, connection ID) to attribute abusive peers

How to Mitigate CVE-2026-100662

Immediate Actions Required

Upgrade io.netty:netty-codec-http3 to 4.2.18.Final or later across all services, container images, and transitive dependencies
Identify internet-exposed HTTP/3 listeners and prioritize them for patching ahead of internal services
Rebuild and redeploy applications that bundle Netty as a shaded or embedded dependency

Patch Information

The maintainers fixed CVE-2026-100662 in Netty 4.2.18.Final. The patch enforces bounds on QPACK encoder-stream literal lengths and prevents unbounded cumulator growth. Review the GitHub Security Advisory for commit references and version guidance.

Workarounds

Disable HTTP/3 support on Netty-based services until the upgrade to 4.2.18.Final can be deployed
Place HTTP/3-terminating proxies or load balancers that enforce QUIC stream and header limits in front of Netty servers
Apply network-layer rate limiting on inbound QUIC/UDP connections to reduce the impact of a single abusive peer

bash

# Maven dependency pin example
# Update pom.xml to require the fixed version
<dependency>
  <groupId>io.netty</groupId>
  <artifactId>netty-codec-http3</artifactId>
  <version>4.2.18.Final</version>
</dependency>