The vulnerability resides in Netty’s Http3FrameCodec, where incoming data for HTTP/3 reserved frame types are buffered up to the wire‑specified payload length without any server‑side limit. Because the decoder trusts the payload length field, an attacker can open multiple QUIC streams and send reserved frames with extremely large lengths, exhausting heap space and causing the application to fail. This is a classic memory exhaustion flaw that can lead to sustained denial of service for the affected process.

The issue affects the Netty network application framework, versions prior to 4.2.16.Final. Clients and servers that use these earlier Netty releases are vulnerable; any deployment of Netty for HTTP/3 traffic is impacted until the update is applied.

The CVSS score of 7.5 reflects a moderate‑to‑high severity. The EPSS score of < 1% indicates a very low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote over the network: an attacker must be able to establish QUIC connections to the vulnerable service. If the application exposes HTTP/3 endpoints to the Internet or untrusted networks, the risk increases, as an attacker can repeatedly send crafted frames to trigger memory exhaustion.