CVE-2026-100661: Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Published Sep 26, 2026
·
Updated

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.

Affected Software

1 affected component
maven/io.netty/netty-codec-http3>=4.2.0.Final<=4.2.17.Final

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade io.netty:netty-codec-http3 to a version that resolves this vulnerability.

    Fixed in 4.2.18.Final

Event History

Sep 26, 2026
CVE Published
via MITRE·01:23 PM
Data Sourced
via MITRE·01:23 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed?

Any deployment using io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final is affected. The issue is reachable in every configuration.

2

What does an attacker need to exploit this issue?

An unauthenticated remote peer only needs network access to open a QPACK unidirectional stream and send a malformed prefixed integer consisting of a saturated prefix followed by continuation bytes. No privileges or user interaction are required.

3

What is the operational impact of exploitation?

A malicious stream can cause unbounded heap growth for the connection, potentially resulting in OutOfMemoryError. Repeated rescanning of the accumulated input also creates O(N^2) CPU work and can starve the event loop.

4

What should teams do to remediate the vulnerability?

Upgrade io.netty:netty-codec-http3 to version 4.2.18.Final, which contains the fix.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203