{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/netty-codec-http3-4.2.0.final---4.2.17.final/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netty:netty-codec-http3:4.2.0.final:*:*:*:*:*:*:*","cpe:2.3:a:netty:netty-codec-http3:4.2.17.final:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-100660"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-codec-http3 (4.2.0.Final - 4.2.17.Final)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","java","networking"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eNetty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final are susceptible to a memory exhaustion vulnerability (CVE-2026-100660). The issue stems from the QpackEncoder component, which retains an unbounded queue and dynamic-table index tracker for every encoded field section referencing the QPACK dynamic table. These objects are stored in memory keyed by the peer-controlled QUIC stream ID and are released exclusively upon receipt of a Section Acknowledgment or Stream Cancellation instruction from the remote decoder.\u003c/p\u003e\n\u003cp\u003eBecause the implementation lacks limits on the number of tracked streams, field sections, or total retained bytes, an unauthenticated attacker can orchestrate a denial-of-service attack. By initiating sequential HTTP/3 requests over a single QUIC connection while omitting mandatory Section Acknowledgments, an attacker forces the server to accumulate entries indefinitely. This bypasses typical concurrent-stream constraints and consumes server heap memory until the process crashes. Defenders should upgrade to version 4.2.18.Final to incorporate the enforced state management and limits.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a persistent denial-of-service state due to heap exhaustion. The vulnerability affects any application utilizing the netty-codec-http3 library version 4.2.0.Final through 4.2.17.Final for HTTP/3 traffic. Because the attack occurs at the HTTP/3 protocol layer, it can impact any public-facing service or microservice infrastructure relying on these specific Netty versions for QUIC/HTTP/3 connectivity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade netty-codec-http3 to version 4.2.18.Final or later across all Java applications immediately.\u003c/li\u003e\n\u003cli\u003eReview HTTP/3 traffic ingress patterns for clients that exhibit high rates of request initiation without corresponding acknowledgment traffic, which may indicate attempted exploitation.\u003c/li\u003e\n\u003cli\u003eApply resource limits on the number of concurrent QUIC streams and total HTTP/3 memory usage at the network load balancer or reverse proxy layer as a temporary mitigation for services that cannot be patched immediately.\u003c/li\u003e\n\u003cli\u003eMonitor Java Virtual Machine (JVM) heap usage metrics for unusual growth spikes occurring concurrently with HTTP/3 traffic volume.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-26T15:07:39Z","date_published":"2026-09-26T15:07:39Z","id":"https://feed.craftedsignal.io/briefs/2026-09-netty-qpack-dos/","summary":"An unauthenticated remote attacker can cause heap exhaustion in applications using Netty's HTTP/3 codec by exploiting improper QPACK dynamic table state management, leading to a denial-of-service condition.","title":"Denial of Service in Netty HTTP/3 Codec via QPACK Encoder State Exhaustion","url":"https://feed.craftedsignal.io/briefs/2026-09-netty-qpack-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Codec-Http3 (4.2.0.Final - 4.2.17.Final)","version":"https://jsonfeed.org/version/1.1"}