CVE-2026-100659

A flaw was found in the Netty HTTP/3 codec. This vulnerability allows access control and request routing bypasses due to missing validation of destination headers. A remote, unauthenticated attacker can exploit this flaw by sending a Hypertext Transfer Protocol HTTP request containing conflicting...

PT-2026-99333

Name of the Vulnerable Software and Affected Versions Netty HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final Description An uncontrolled resource consumption issue exists in the QPACK encoder-stream instruction decoder within the QpackEncoderHandler installed on the peer-initiated...