Skip to content
Threat Feed
Subscribe

Tag

Http3

3 briefs RSS
low advisory

Netty HTTP/3 Codec Vulnerability Leads to Denial of Service via Memory Exhaustion

A vulnerability in Netty's HTTP/3 `Http3FrameCodec`, tracked as CVE-2026-56816, allows an unauthenticated remote attacker to cause a denial of service by sending crafted reserved HTTP/3 frames with an excessively large, unvalidated payload length, leading to server memory exhaustion.

netty-codec-http3 denial-of-service vulnerability java netty http3
1t 1c
medium advisory

CVE-2026-40898: quic-go HTTP/3 Memory Exhaustion DoS

A vulnerability in quic-go, an implementation of the QUIC protocol in Go, allows a remote attacker to cause a denial-of-service (DoS) condition by sending specially crafted QPACK-encoded HEADERS frames with large trailer field sections, leading to excessive memory allocation in affected HTTP/3 client and server implementations prior to version 0.59.1.

PoC quic-go denial-of-service vulnerability network http3 quic golang
1t 2c updated
medium advisory

Netty HTTP/3 QPACK Literal Unbounded Allocation Vulnerability

A vulnerability in Netty's HTTP/3 QPACK decoder allows an attacker to cause a denial of service by sending a crafted HTTP/3 header that triggers excessive memory allocation, leading to a server crash.

netty-codec-http3 netty http3 qpack denial-of-service vulnerability
3r 1t