privacytests

PrivacyTests PrivacyTests is an open-source testing program that measures browser privacy characteristics, and a website, https://privacytests.org, that renders the results for human consumption. PrivacyTests uses the MIT license. aioquic: a submodule with a fork of the aioquic project for...

HTTP3-Adapter

HTTP/3-Adapter A Burp Suite extension that sends requests over HTTP/3. Burp does not support HTTP/3 natively. This extension implements a HTTP/3 stack, intercepts all requests, converts and sends them over HTTP/3 and then converts the response back into a HTTP version that burp can understand...

HTTP Authority Confusion

io.netty, netty-codec-http3 is vulnerable to HTTP authority confusion. The vulnerability is due to the codec prioritizing the Host header over the authority specified in the absolute-form request-target, which allows a remote attacker to manipulate virtual-host routing, authorization checks,...

HTTP CONNECT Tunnel Authority Validation Bypass

io.netty:netty-codec-http3 is vulnerable to HTTP CONNECT tunnel authority validation bypass. The vulnerability is due to incorrect parsing and conversion of HTTP/1 CONNECT requests in HttpConversionUtil.toHttp3Headers, which allows a remote attacker to manipulate the Host header to specify an...

Uncontrolled Resource Consumption

io.netty, netty-codec-http3 is vulnerable to uncontrolled resource consumption. The vulnerability is due to improper validation and lack of size limits on QPACK encoder-stream string literals, which allows a remote unauthenticated attacker to exhaust server heap memory and trigger an...

Denial-Of-Service (DoS)

io.netty, netty-codec-http3 is vulnerable to a denial-of-service DoS. The vulnerability is due to unbounded processing of continuation bytes, which allows a remote, unauthenticated attacker to exhaust heap memory and consume excessive CPU resources by sending malformed QPACK data, potentially...

Denial Of Service (DoS)

io.netty:netty-codec-http3 is vulnerable to Denial of service DoS. The vulnerability is due to QPACK encoder state being retained without limits or being released when HTTP/3 streams complete, which allows a remote, unauthenticated attacker to exhaust server memory by sending sequential HTTP/3...

HTTP Request Authority Confusion

io.netty, netty-codec-http3 is vulnerable to HTTP request authority confusion. The vulnerability is due to the failure to enforce matching authority values, which allows a remote unauthenticated attacker to bypass routing, virtual-host, and access-control restrictions by sending a crafted HTTP/3...

Astra Linux – Vulnerability in Wireshark

The HTTP3 dissector in Wireshark versions 4.6.0 and 4.6.1 allows for denial of service attacks...

io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

ROOT-APP-MAVEN-AIKIDO-2026-110281 AIKIDO-2026-110281 in io.netty:netty-codec-http3 - Patched by Root

Root has patched AIKIDO-2026-110281 in the io.netty:netty-codec-http3 package for Root:Maven. Multiple fixed versions available...

PT-2026-116581

Root has patched AIKIDO-2026-110281 in the io.netty:netty-codec-http3 package for Root:Maven. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-100660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a...

Linux Distros Unpatched Vulnerability : CVE-2026-100664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header...

Linux Distros Unpatched Vulnerability : CVE-2026-100662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPAC...

Linux Distros Unpatched Vulnerability : CVE-2026-100659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority...

Linux Distros Unpatched Vulnerability : CVE-2026-100663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special- case HTTP/1 CONNECT authority-form request-targets when...

Linux Distros Unpatched Vulnerability : CVE-2026-100661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-intege...

CVE-2026-100660

A flaw was found in Netty's HTTP/3 codec netty-codec-http3. The HTTP/3 header compression QPACK encoder stores per-stream state indefinitely when remote clients do not acknowledge encoded data, as no memory limits are enforced. A remote, unauthenticated attacker can exploit this flaw by issuing...

CVE-2026-100663

A flaw was found in Netty's HTTP/3 codec netty-codec-http3. A remote attacker can bypass security policies and tunnel allowlists when Netty acts as an HTTP/1 to HTTP/3 proxy or gateway. Due to improper translation of HTTP/1 CONNECT requests, the component uses the attacker-controlled Host header ...