Netty’s HTTP/3 codec contains a flaw that allows an attacker to create an infinite number of blocked streams, causing the application to consume increasing amounts of memory until it triggers an Out‑of‑Memory error. This memory exhaustion can crash or otherwise destabilize a Netty‑based server, resulting in a denial of service. The weakness is classified as CWE‑770, Memory Allocation.

The vulnerability impacts the Netty network application framework, specifically versions released before 4.2.15.Final. All deployments that use Netty’s HTTP/3 codec and have not applied the 4.2.15.Final update are susceptible.

With a CVSS score of 7.5 the flaw is considered high severity. EPSS indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote client that sends crafted HTTP/3 traffic to the vulnerable Netty server, but the description does not explicitly state the vector, so this is inferred from the impact of incoming blocked streams.