Netty HTTP/3 CVE-2026-100659

Requires the target to run Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final and to accept HTTP/3 (QUIC) connections from the network. Exploitation is remote and unauthenticated (PR:N/UI:N) with a single HEADERS frame carrying both :authority and a literal host header set to different values. The security-relevant impact only materializes in a multi-component request path (e.g., a front-end proxy/gateway plus a backend application) where different components make routing, virtual-host, or access-control decisions from different authority fields; a single monolithic consumer that reads only one field sees reduced or no security consequence. HTTP/3 must be enabled and reachable, which limits exposure relative to ubiquitous HTTP/1.1 deployments.

This is a genuine but moderate-severity integrity issue, not a critical remote-code-execution flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) confirms a network-reachable, low-complexity, unauthenticated attack with only LOW confidentiality and integrity impact and no availability impact, yielding a base score of 6.9 (MEDIUM). CWE-444 (inconsistent interpretation of HTTP requests / request smuggling) accurately captures the root cause: the HTTP/3 codec fails to enforce RFC 9114's requirement that a :authority pseudo-header and a literal host header agree, so two request-path components can resolve two different authorities. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data - exploitation status is therefore 'no public exploit identified at time of analysis.' Real-world risk is elevated by the trivial unauthenticated network vector and the ubiquity of Netty as a JVM networking substrate, but tempered by the fact that impact is confined to routing/access-control confusion (no direct data theft or code execution) and requires a specific deployment topology where distinct components consult different authority fields. No SSVC decision data was supplied. Net: a real defense-in-depth patch priority for internet-facing HTTP/3 gateways/proxies built on Netty, but not an emergency.

An unauthenticated remote attacker sends a single crafted HTTP/3 HEADERS frame containing both a :authority pseudo-header and a host header with differing, attacker-chosen values to a Netty-based HTTP/3 front end. A front-end proxy or router keys its access-control or virtual-host decision on one field while a downstream component consults the other, letting the attacker reach a restricted vhost or bypass routing/authorization boundaries. No public proof-of-concept is identified in the provided data.