When decoding HTTP/3 QPACK header blocks, Netty's QpackDecoder creates a new byte array for a literal string without first verifying that the encoded length is within the bounds of the available data. The wire format allows a very large length value to be encoded in only a few bytes, so a crafted message can cause an unbounded allocation. This overflow can exhaust memory resources and cause the application to crash or become unresponsive, representing a denial‑of‑service vulnerability (CWE‑770, CWE‑789).

The flaw affects the Netty framework, specifically the io.netty:netty-codec-http3 and netty:netty implementations, before the 4.2.13.Final release. Any application that relies on these Netty components to process HTTP/3 traffic is potentially vulnerable.

The CVSS score is 7.5, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, exploiting the ability to send crafted HTTP/3 header packets over the network; thus any node exposed to HTTP/3 traffic could be targeted. If an attacker can inject the oversized literal into the stream, the vulnerable decoder will perform the out‑of‑bounds allocation and trigger the denial of service. No conditions beyond the presence of a header literal longer than the remaining bytes are required, making exploitation relatively straightforward for an attacker who can influence the traffic.