Netty’s HTTP/3 codec (netty-codec-http3) retains unbounded memory for the QPACK encoder state. Each HTTP/3 stream that stores a dynamic table reference keeps a queue and index tracker keyed by the peer‑controlled QUIC stream ID. These entries are released only after a remote decoder acknowledgment or stream cancellation, not when the stream finishes. Because the number of streams, field sections, or retained bytes is unbounded, a malicious client can intentionally prevent cleanup, causing the server to keep memory until it runs out, resulting in a denial of service. This weakness is classified as CWE‑770, Uncontrolled Resource Allocation.

The vulnerability affects Netty’s http/3 codec for all releases from 4.2.0.Final through 4.2.17.Final inclusive. Version 4.2.18.Final and later contain the fix. Applications that embed netty-codec-http3 in this version range and accept HTTP/3 connections are at risk.

The CVSS score of 8.7 reflects a high impact denial‑of‑service risk. EPSS is not available, but the lack of authentication and the possibility to send controlled QPACK requests make exploitation straightforward for a remote client. The vulnerability is not listed in CISA KEV; however, its high CVSS, lack of mitigation in current releases, and remote nature combine to present a significant threat to any service exposing HTTP/3 over Netty.