CVE-2026-100664: Netty 4.2.2 through 4.2.15 HTTP/1 Host Header Authority Confusion
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge, a remote client can send a request such as "GET https://trusted.example/admin HTTP/1.1" with "Host: attacker.example", causing components that validate, authorize, or route on the RFC-defined request-target authority to reach a different decision than the upstream HTTP/3 peer, which receives :authority derived from the conflicting Host header. This authority confusion can affect virtual-host routing, allow-list checks, backend selection, cache keys, and URL generation. The advisory reports integrity impact only (no code execution, memory corruption, or availability impact). Fixed in 4.2.18.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-http3to a version that resolves this vulnerability.Fixed in 4.2.18.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure is described for Netty-based HTTP/1-to-HTTP/3 gateways, proxies, or protocol bridges that convert HTTP/1 requests to HTTP/3 using Http3FrameToHttpObjectCodec(false). Deployments that use authority values for virtual-host routing, authorization, allow lists, backend selection, cache keys, or URL generation are particularly relevant.
What must an attacker send to trigger the authority mismatch?
A remote client must send an absolute-form HTTP/1 request-target whose authority conflicts with a non-empty Host header. The conversion uses the Host value for the HTTP/3 :authority header even though HTTP/1.1 requires the request-target authority to take precedence for absolute-form requests.
What is the practical security impact?
Different components can make security or routing decisions using different authorities: one may use the request-target authority while the upstream HTTP/3 peer receives the Host-derived authority. The reported impact is integrity only; no code execution, memory-corruption, or availability impact is reported.
Which versions are identified in the provided advisory information?
The description identifies io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final. The title separately says 4.2.2 through 4.2.15, so the provided information contains a version-range inconsistency; no fixed version is supplied.