CVE-2026-100661: Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-http3to a version that resolves this vulnerability.Fixed in 4.2.18.Final
Event History
Frequently Asked Questions
Which deployments are exposed?
Any deployment using io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final is affected. The issue is reachable in every configuration.
What does an attacker need to exploit this issue?
An unauthenticated remote peer only needs network access to open a QPACK unidirectional stream and send a malformed prefixed integer consisting of a saturated prefix followed by continuation bytes. No privileges or user interaction are required.
What is the operational impact of exploitation?
A malicious stream can cause unbounded heap growth for the connection, potentially resulting in OutOfMemoryError. Repeated rescanning of the accumulated input also creates O(N^2) CPU work and can starve the event loop.
What should teams do to remediate the vulnerability?
Upgrade io.netty:netty-codec-http3 to version 4.2.18.Final, which contains the fix.