CVE-2026-100660

The Netty HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final are vulnerable to a denial of service (DoS) due to unbounded per-stream QPACK encoder state retention. The QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section re...

CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

EUVD-2026-87754

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

CVE-2026-100660

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100659

Netty's HTTP/3 codec (io.netty:netty-codec-http3 ) in versions 4.2.0.Final through 4.2.17.Final fails to enforce the RFC 9114 requirement that the :authority pseudo-header and a literal host header must carry the same value. A remote unauthenticated peer can submit a HEADERS frame with conflictin...

CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100659

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100659: Inconsistent Interpretation of HTTP Requests

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

PT-2026-99335

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final Description The HTTP/3 codec incorrectly builds the :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. Th...

PT-2026-99334

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final Description The HTTP/3 codec fails to properly handle HTTP/1 CONNECT authority-form request-targets during the conversion of HTTP/1 messages to HTTP/3 within the toHttp3Headers functi...

CVE-2026-100663: Improper Input Validation

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

PT-2026-99333

Name of the Vulnerable Software and Affected Versions Netty HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final Description An uncontrolled resource consumption issue exists in the QPACK encoder-stream instruction decoder within the QpackEncoderHandler installed on the peer-initiated...

CVE-2026-100660: Allocation of Resources Without Limits or Throttling

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

SUSE CVE-2026-93568

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

SUSE CVE-2026-48521

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transportsocketoptions while selecting an HTTP/3 connection pool without first checking whether the...

FreeBSD : Angie -- worker process memory corruption when using HTTP/3 (6cf2ff4b-b38c-11f1-a655-3497f65b111b)

"The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6cf2ff4b-b38c-11f1-a655-3497f65b111b advisory. The Angie Software Team reports: When using an OpenSSL version without native HTTP/3 support 3.5.0 or...