CVE-2026-44892: Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
Summary The default configuration of the Http3ConnectionHandler in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify HTTP3SETTINGSMAXFIELDSECTIONSIZE, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an OutOfMemoryError.
Details Netty securely limits header sizes for older protocols. In HTTP/1.1, Netty strictly enforces an 8192-byte limit out-of-the-box via HttpObjectDecoder. For HTTP/2, while RFC 9113 specifies that SETTINGSMAXHEADERLISTSIZE defaults to unlimited, Netty securely overrides this RFC default by enforcing an 8192-byte limit (Http2CodecUtil.DEFAULTHEADERLISTSIZE).
However, this secure-by-default configuration is missing in the HTTP/3 implementation. While Netty provides a mechanism to configure the maximum header field section size via Http3Settings, its out-of-the-box behaviour strictly follows RFC 9114's unlimited default.
Because many developers rely on the framework's default configurations and basic constructors, their applications are unknowingly left vulnerable. This nearly infinite default limit is passed into Http3FrameCodec#newFactory and stored as maxHeaderListSize inside Http3FrameCodec.
A bad actor can continuously send HTTP/3 headers within a connection, exploiting the insecure default configuration to consume server memory unconditionally until the application crashes with an OutOfMemoryError.
Impact Denial of Service via memory exhaustion. All applications using Netty's HTTP/3 codec with its default configuration are impacted.
Other sources
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the Http3ConnectionHandler in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify HTTP3SETTINGSMAXFIELDSECTIONSIZE, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an OutOfMemoryError. Version 4.2.15.Final contains a patch.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-codec-http3to a version that resolves this vulnerability.Fixed in 4.2.15.Final - Upgrade
Upgrade
Netty HTTP/3 codec (Http3ConnectionHandler / Http3FrameCodec)to a version that resolves this vulnerability.Fixed in 4.2.15.Final - Configuration
Configure Http3Settings so peers do not fall back to an unbounded HTTP/3 max header field section size; ensure HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE is set to a finite value instead of relying on the default unbounded behavior.
Netty HTTP/3 codec (Http3Settings / Http3ConnectionHandler) HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE = set a bounded maximum (do not use the RFC-unbounded default)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44892?
The severity of CVE-2026-44892 is classified as high, with a score of 7.5.
How do I fix CVE-2026-44892?
To fix CVE-2026-44892, configure the `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE` to enforce a maximum header size limit.
What impacts can CVE-2026-44892 have on my system?
CVE-2026-44892 can allow an attacker to exploit unbounded header sizes, potentially leading to denial of service.
Which software is affected by CVE-2026-44892?
CVE-2026-44892 affects the Netty HTTP/3 codec specifically version maven/io.netty:netty-codec-http3.
When was CVE-2026-44892 published?
CVE-2026-44892 was published on June 8, 2026.