2 matches found
CVE-2026-100663
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...
8.7CVSS5.9AI score0.00301EPSS
SaveExploits0References2
CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...
8.7CVSS0.00301EPSS
SaveExploits0References2
20