RHLW-2026-ebef76b1d44dd738: Lightwell Security Advisory: netty-codec-http3 4.2.13.Final-rhlw-00001

Q: Which deployments are most exposed to these issues?

Deployments using io.netty:netty-codec-http3 and accepting HTTP/3 traffic are exposed to denial-of-service risks involving unbounded header sizes, QPACK blocked streams, and reserved frame types. The advisory does not identify any affected applications beyond users of this artifact.

Q: Is the default configuration affected?

Yes. CVE-2026-44892 is specifically described as a vulnerable default configuration that permits denial of service through unbounded HTTP/3 header size.

Q: What should teams do to remediate the issues?

Use the Red Hat Lightwell release of io.netty:netty-codec-http3 4.2.13.Final-rhlw-00001 containing backported fixes for CVE-2026-44892, CVE-2026-48748, and CVE-2026-56816. The advisory states that this patched artifact is a drop-in replacement for the same-version artifact from Maven Central.

Published Nov 6, 2026

Updated

Red Hat Lightwell has released io.netty:netty-codec-http3 4.2.13.Final-rhlw-00001 with backported fixes for CVE-2026-44892, CVE-2026-48748, and CVE-2026-56816.

CVE-2026-44892: Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size

CVE-2026-48748: Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

CVE-2026-56816: Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

This patched artifact is a drop-in replacement for io.netty:netty-codec-http3 4.2.13.Final-rhlw-00001 from Maven Central.

Affected Software

1 affected componentFixes available

red-hat-lightwell/io.netty:netty-codec-http3<4.2.13.Final-rhlw-00001

4.2.13.Final-rhlw-00001

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/io.netty:netty-codec-http3 to a version that resolves this vulnerability.
Fixed in 4.2.13.Final-rhlw-00001
Upgrade
Upgrade io.netty:netty-codec-http3 to a version that resolves this vulnerability.
Fixed in 4.2.13.Final-rhlw-00001

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are most exposed to these issues?

Deployments using io.netty:netty-codec-http3 and accepting HTTP/3 traffic are exposed to denial-of-service risks involving unbounded header sizes, QPACK blocked streams, and reserved frame types. The advisory does not identify any affected applications beyond users of this artifact.

Is the default configuration affected?

Yes. CVE-2026-44892 is specifically described as a vulnerable default configuration that permits denial of service through unbounded HTTP/3 header size.

What should teams do to remediate the issues?

Use the Red Hat Lightwell release of io.netty:netty-codec-http3 4.2.13.Final-rhlw-00001 containing backported fixes for CVE-2026-44892, CVE-2026-48748, and CVE-2026-56816. The advisory states that this patched artifact is a drop-in replacement for the same-version artifact from Maven Central.

RHLW-2026-ebef76b1d44dd738: Lightwell Security Advisory: netty-codec-http3 4.2.13.Final-rhlw-00001

Affected Software

Remediation

Child vulnerabilities

Frequently Asked Questions

Which deployments are most exposed to these issues?

Is the default configuration affected?

What should teams do to remediate the issues?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to these issues?

Is the default configuration affected?

What should teams do to remediate the issues?