Skip to content
Threat Feed
Subscribe

Tag

Http3

2 briefs RSS
low advisory

Netty HTTP/3 Codec Vulnerability Leads to Denial of Service via Memory Exhaustion

A vulnerability in Netty's HTTP/3 `Http3FrameCodec`, tracked as CVE-2026-56816, allows an unauthenticated remote attacker to cause a denial of service by sending crafted reserved HTTP/3 frames with an excessively large, unvalidated payload length, leading to server memory exhaustion.

netty-codec-http3 denial-of-service vulnerability java netty http3
1t 1c
medium advisory

Netty HTTP/3 QPACK Literal Unbounded Allocation Vulnerability

A vulnerability in Netty's HTTP/3 QPACK decoder allows an attacker to cause a denial of service by sending a crafted HTTP/3 header that triggers excessive memory allocation, leading to a server crash.

netty-codec-http3 netty http3 qpack denial-of-service vulnerability
3r 1t