The vulnerability lies in Netty's HTTP/3 codec, where the QPACK encoder-stream decoder accepts an attacker-specified string-literal length up to the maximum integer value for name and value fields in the "Insert With Literal Name" instruction. Because no per-instruction cap or cumulative size check exists, the decoder can reserve an enormous amount of memory and the per-connection buffer can grow until a large byte-array allocation fails, causing an OutOfMemoryError. The direct result is a denial of service. This weakness is an uncontrolled resource consumption flaw (CWE-400) and involves excessive resource allocation (CWE-770).

Netty (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final are affected. The vulnerability is triggered on a Netty HTTP/3 server that has the QPackEncoderHandler installed on the peer-initiated unidirectional encoder stream of type 0x02.

The CVSS score of 8.7 classifies this as high severity. No EPSS value is available, and the vulnerability is not listed in CISA's KEV catalog. The attacker must establish an unauthenticated HTTP/3 connection and send a crafted packet with an exaggerated literal length, then send fewer bytes than declared. The decoder’s buffer growth will eventually exhaust heap memory, leading to service disruption. Given the lack of mitigations in the current code, exploitation requires only the ability to open a protocol connection and send data, making the attack vector relatively straightforward for an unauthenticated remote actor.