Unbounded Memory Retention Vulnerability in Netty's HTTP/3 Codec
CVE-2026-100660

8.7HIGH

Key Information:

Vendor

Netty

Status
Netty
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100660?

The Netty HTTP/3 codec contains a flaw where the QpackEncoder does not properly limit the memory tracked per-stream, leading to potential unbounded memory retention. This occurs because the encoder retains state for each encoded field section associated with peer-controlled QUIC stream IDs. If a malicious HTTP/3 client manipulates requests without adhering to acknowledgment requirements, it can cause extensive memory consumption on the server. This may lead to denial of service as server memory resources are exhausted over time. The issue is resolved in version 4.2.18.Final.

Affected Version(s)

netty 0 < 4.2.18.Final

netty 4.2.18.Final

References

https://github.com/netty/netty/security/advisories/GHSA-4...
vendor-advisory
https://www.vulncheck.com/advisories/netty-before-4.2.18-...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hussst
.