A configuration flaw in Netty’s HTTP/3 codec allows an attacker to send header data without a prescribed limit when the HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE value is not explicitly set by a peer. The resulting unbounded allocation leads to OutOfMemory errors that halt the application, producing a denial of service. The weakness exploits a lack of input validation on header size and is categorized under CWE‑1188 and CWE‑400.

The issue affects all Netty deployments using the Http3ConnectionHandler component prior to version 4.2.15.Final. The vendor, Netty, released a patched build in the 4.2.15.Final release that implements a default maximum header size. Systems remaining on older releases or those that still rely on the default configuration are vulnerable.

The CVSS score of 7.5 indicates moderate to high severity. While no EPSS score is reported, the possibility of exploitation remains, particularly against exposed HTTP/3 services. The vulnerability is not listed in the CISA KEV catalog. An attacker can remotely trigger the vulnerability by issuing a crafted HTTP/3 request containing a very large header section, likely from the network layer. No privileged access or local code execution is required, so the risk applies to any reachable HTTP/3 endpoint.