4429 matches found
CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...
CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...
CVE-2026-100661 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...
CVE-2026-100661 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...
CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...
CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...
CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...
CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...
EUVD-2026-87754
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...
CVE-2026-100658 Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler
Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...
CVE-2026-100659
Netty's HTTP/3 codec (io.netty:netty-codec-http3 ) in versions 4.2.0.Final through 4.2.17.Final fails to enforce the RFC 9114 requirement that the :authority pseudo-header and a literal host header must carry the same value. A remote unauthenticated peer can submit a HEADERS frame with conflictin...
CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...
EUVD-2026-87752
Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...
CVE-2026-100658
Removed by vendor...
CVE-2026-100658
The Netty component (io.netty:netty-codec-http ) is vulnerable to a denial-of-service (DoS) attack due to an unbounded per-connection queue in WebSocketServerExtensionHandler . An unauthenticated remote peer can use HTTP/1.1 pipelining to send requests faster than the application produces respons...
CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...
CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...
CVE-2026-100657 Netty before 4.1.138.Final ByteBuf Leak in StompSubframeDecoder
Netty's STOMP codec io.netty:netty-codec-stomp contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that...