Netty's HTTP/3 codec contains a denial‑of‑service flaw in the QPACK prefixed‑integer decoder. The decoder accepts an unbounded number of continuation bytes, causing the internal buffer to grow without limit. When a remote peer sends a specially crafted stream filled with continuation bytes, the decoder continuously returns a request to read more data, and the accumulated buffer size grows until the process runs out of memory. The CPU cost rises quadratically because each decode call rescans the entire buffer, resulting in event‑loop starvation. The net effect is an OutOfMemoryError and loss of service for honest connections.

The issue affects any deployment that includes Netty 4.2.0.Final through 4.2.17.Final in the HTTP/3 codec module (io.netty:netty-codec-http3). It is relevant for all environments that use Netty's HTTP/3 support, regardless of the higher‑level application stack.

The CVSS score of 8.7 indicates high severity. No EPSS score is reported, but the vulnerability can be triggered by any unauthenticated HTTP/3 client without special privileges. The flaw is reachable in every configuration of Netty's HTTP/3 support, making a DoS attack practical. The flaw is not listed in the CISA KEV catalog, which suggests that active exploitation may not yet be widespread.