Linux Distros Unpatched Vulnerability : CVE-2026-100660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a...

Linux Distros Unpatched Vulnerability : CVE-2026-100662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPAC...

CVE-2026-42530

CVE-2026-42530 Scanner for CVE-2026-42530, a use-after-free in nginx's HTTP/3 module. Affected: nginx 1.31.0, 1.31.1 Fixed: nginx 1.31.2 Usage pip install aioquic python3 scannerCVE-2026-42530.py port python3 scannerCVE-2026-42530.py --file hosts.txt How it works Opens two QPACK encoder streams o...

CVE-2026-42530

🛡️ CVE-2026-42530 - NGINX HTTP/3 QUIC Use-After-Free Vulnerability High-Severity Use-After-Free in NGINX HTTP/3 QUIC ⚠️ QPACK Encoder Stream Vulnerability 🔍 Overview CVE-2026-42530 is a use-after-free vulnerability in NGINX's ngxhttpv3module. A remote unauthenticated attacker can trigger it by...

CVE-2026-100660

A flaw was found in Netty's HTTP/3 codec netty-codec-http3. The HTTP/3 header compression QPACK encoder stores per-stream state indefinitely when remote clients do not acknowledge encoded data, as no memory limits are enforced. A remote, unauthenticated attacker can exploit this flaw by issuing...

CVE-2026-100661

A flaw was found in Netty's HTTP/3 codec. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a specially crafted stream of data to the QPACK integer decoder. Because the decoder fails to limit incoming continuation bytes, data accumulates indefinitely in memory while...

UBUNTU-CVE-2026-100662

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...

UBUNTU-CVE-2026-100661

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

CVE-2026-100660

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

UBUNTU-CVE-2026-100660

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...

EUVD-2026-87755

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

CVE-2026-100661 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

CVE-2026-100661 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...

CVE-2026-100660

The Netty HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final are vulnerable to a denial of service (DoS) due to unbounded per-stream QPACK encoder state retention. The QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section re...

EUVD-2026-87754

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...

Fedora 43 : erlang-cowboy / erlang-cowlib (2026-ce97d80dae)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-ce97d80dae advisory. Coordinated security update of cowlib and cowboy, released together upstream on 2026-07-27. cowlib 2.19.0 fixes CVE-2026-59248: unbounded HPACK/QPAC...

CVE-2026-59248

Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server or client and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cowhpackcommon:decbigint/3 in...