CVE-2026-100661

Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Published Sep 26, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.

Analysis

Technical impact

Netty's HTTP/3 codec contains a denial‑of‑service flaw in the QPACK prefixed‑integer decoder. The decoder accepts an unbounded number of continuation bytes, causing the internal buffer to grow without limit. When a remote peer sends a specially crafted stream filled with continuation bytes, the decoder continuously returns a request to read more data, and the accumulated buffer size grows until the process runs out of memory. The CPU cost rises quadratically because each decode call rescans the entire buffer, resulting in event‑loop starvation. The net effect is an OutOfMemoryError and loss of service for honest connections.

Affected Systems

The issue affects any deployment that includes Netty 4.2.0.Final through 4.2.17.Final in the HTTP/3 codec module (io.netty:netty-codec-http3). It is relevant for all environments that use Netty's HTTP/3 support, regardless of the higher‑level application stack.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. No EPSS score is reported, but the vulnerability can be triggered by any unauthenticated HTTP/3 client without special privileges. The flaw is reachable in every configuration of Netty's HTTP/3 support, making a DoS attack practical. The flaw is not listed in the CISA KEV catalog, which suggests that active exploitation may not yet be widespread.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

netty

unaffected

Version	Status	Constraints
`4.2.0.Final`	affected	< 4.2.18.Final
`4.2.18.Final`	unaffected	—

No data.

Vendor Product Versions

Netty

Version	Status	Scheme	Platform
`[4.2.0.Final,4.2.18.Final)`	affected	generic	—
`4.2.18.Final`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Netty 4.2.18.Final or later.
If upgrade is not immediately possible, block or rate‑limit QPACK unidirectional streams to prevent oversized continuation streams.
Monitor for CPU exhaustion or memory spikes in Netty event loops and apply hard caps on request queue lengths or buffer sizes when feasible.

Generated by OpenCVE AI on September 27, 2026 at 01:22 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.344% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx
https://nvd.nist.gov/vuln/detail/CVE-2026-100661
https://www.cve.org/CVERecord?id=CVE-2026-100661
https://www.vulncheck.com/advisories/netty-http-3-qpack-prefixed-integer-dos-via-unbounded-accumulation

History

Oct 2, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 27, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-100661 https://www.cve.org/CVERecord?id=CVE-2026-100661
Metrics	threat_severity `None`	threat_severity `Important`

Sep 26, 2026 1:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.
Title		Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
First Time appeared		Netty Netty netty
Weaknesses		CWE-400
CPEs		cpe:2.3:a:netty:netty::::::::
Vendors & Products		Netty Netty netty
References		https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx https://www.vulncheck.com/advisories/netty-http-3-qpack-prefixed-integer-dos-via-unbounded-accumulation
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`