EUVD-2026-87755
GHSA-7m86-g9j9-26xf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOpen HTTP/3 QUIC connection to server
-
DeliveryOpen QPACK unidirectional stream (0x02/0x03)
-
ExploitSend all-prefix-bits byte + endless 0x80 run
-
ExecutionDecoder returns -1, cumulator grows unbounded
-
PersistO(N^2) re-scan starves event loop
-
ImpactHeap exhaustion (OOM) / service outage
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target run Netty's HTTP/3 codec (io.netty:netty-codec-http3) at versions 4.2.0.Final through 4.2.17.Final and accept inbound HTTP/3 (QUIC) connections. The advisory explicitly states the flaw is 'reachable in every configuration' - no special feature flag, authentication, or non-default setting is needed; any peer able to open a QPACK encoder (0x02) or decoder (0x03) unidirectional stream can trigger it. The only real limiting factors are that HTTP/3/QUIC must be exposed and enabled (many Netty deployments use HTTP/1.1 or HTTP/2 only, in which case this codec is not loaded) and that the impact is confined to denial of service - resource exhaustion and event-loop starvation, with no path to code execution or data disclosure. |
| Impact | This is a genuine but availability-only risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and the impact profile is VA:H with VC:N/VI:N/VA:H - a pure denial-of-service (CWE-400 resource exhaustion), no confidentiality or integrity impact. The 8.7 vendor score is driven entirely by the availability metric plus the trivial attack requirements. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation; the threat is theoretical-but-easy rather than observed-in-the-wild. The description is internally consistent with the vector - 'reachable in every configuration' matches AC:L/PR:N/UI:N - so no signal conflicts. Net: a real, prioritize-if-you-run-HTTP/3 patch, but the ceiling is service disruption, not compromise, so it should rank below any RCE/data-exposure issues in the same maintenance window. |
| Exploit ScenarioDerived | A remote unauthenticated attacker establishes an HTTP/3 (QUIC) connection to a Netty-based server and opens a QPACK unidirectional stream (type 0x02 or 0x03), sends a first byte with all prefix bits set (0xFF/0x3F) followed by an unending stream of 0x80 continuation bytes. Because the decoder never signals completion, the accumulation buffer grows without bound and each decode pass re-scans it, driving O(N^2) CPU and heap exhaustion until the process hits OutOfMemoryError or the event loop starves. No public exploit code was identified at time of analysis, though the technique is fully described in the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Remote denial of service in Netty's HTTP/3 codec (io.netty:netty-codec-http3) 4.2.0.Final through 4.2.17.Final lets an unauthenticated remote peer exhaust server memory and CPU by opening a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and sending an all-prefix-bits first byte followed by an endless run of 0x80 continuation bytes. Because QpackUtil.decodePrefixedInteger returns -1 ("need more bytes") without consuming input, the ByteToMessageDecoder cumulator grows without bound and each decode() call re-scans the whole accumulated buffer at O(N^2) CPU cost, producing unbounded per-connection heap growth (OutOfMemoryError) and event-loop starvation. Netty's own advisory states the flaw is reachable in every configuration with no special flag or non-default setting, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms an availability-only impact with no confidentiality or integrity exposure; no public exploit code or CISA KEV entry was identified at time of analysis, and vendor-released patch 4.2.18.Final is available.
RemediationAI
Vendor-released patch: upgrade io.netty:netty-codec-http3 (and the parent Netty dependency) to 4.2.18.Final, which bounds the continuation-byte processing in QpackUtil.decodePrefixedInteger; this is the only complete fix and should be treated as mandatory for any service exposing HTTP/3, with the advisory at https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx confirming availability and VulnCheck's write-up at https://www.vulncheck.com/advisories/netty-http-3-qpack-prefixed-integer-dos-via-unbounded-accumulation providing supporting detail. If immediate upgrade is not possible, the most effective compensating control is to stop exposing HTTP/3/QUIC entirely - remove or disable the HTTP/3 listener/ALPN h3 advertisement and serve clients over HTTP/2 or HTTP/1.1 - because the vulnerable codec is never loaded on those paths; the trade-off is loss of QUIC's latency and connection-migration benefits and possible client fallback churn. Operators who must keep HTTP/3 can additionally cap concurrent QUIC connections and streams per peer and set per-connection memory ceilings at the load balancer or reverse proxy, and can rate-limit or reject QPACK/QPACK-adjacent unidirectional streams that exceed a sane length, at the cost of potentially throttling legitimate clients and of requiring front-end support for inspecting QUIC streams (which many L4 balancers cannot do since QUIC is encrypted). Note that no vendor-issued workaround is documented in the provided references, so any partial mitigation should be treated as defense-in-depth until 4.2.18.Final is deployed, and monitoring for repeated "need more bytes"/buffer-growth patterns or event-loop latency spikes can serve as an interim detection signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QPACK is the header-compression scheme defined for HTTP/3 (RFC 9204), the QUIC-based successor to HTTP/2's HPACK; like HPACK it encodes small integers with a prefix-and-continuation scheme (RFC 7541-style prefixed integers), where the high bits of a first byte are the prefix and 0x80-flagged following bytes extend the value. Netty's QpackUtil.decodePrefixedInteger implements that decode loop but imposes no upper bound on the number of continuation bytes it will accept, so a stream consisting of a prefix-saturated first byte (0xFF for a 7-bit prefix, 0x3F for a 5-bit prefix) followed by an arbitrarily long run of 0x80 bytes never terminates and never advances the reader index. This maps to CWE-400 (Uncontrolled Resource Consumption): the failure mode is not corruption or code execution but a missing input-length/iteration guard, which turns into two distinct resource attacks - per-connection heap accumulation as the cumulator retains the un-consumed bytes, and CPU amplification because every re-entry into decode() rescans the entire buffer rather than the new bytes only. The CPE entry cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* and the EUVD range "netty 4.2.0.Final <4.2.18.Final" both identify the Netty project artifact; the codec is only loaded by deployments that actually enable HTTP/3 over QUIC, so applications serving exclusively HTTP/1.1 or HTTP/2 are not on the vulnerable path even though the library version may be in range.
Know when Netty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, low-complexity with no user interaction and reachable in every configuration (AV:N/AC:L/PR:N/UI:N); pure availability impact via memory/CPU exhaustion so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.
Articles & Coverage 1
Technical POC Analysis
Uncontrolled resource consumption (CWE-400; advisory also maps CWE-770 unbounded allocation and CWE-834 excessive iteration) in Netty's QPACK prefixed-integer decoder.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A memory- and CPU-exhaustion flaw in Netty's HTTP/3 codec (io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final) lets any unauthenticated network peer degrade or crash services that accept HTTP/3 traffic, and Netty's advisory states the flaw is reachable in every configuration with no special flag or non-default setting required. Because Netty is embedded in a broad range of Java gateways, API platforms, and streaming services, the exposure footprint is likely wider than the set of applications directly identified by the owning teams, and the impact is availability-only with no confidentiality or integrity exposure. Leadership should care because a single low-effort connection can exhaust per-connection heap and starve event loops, turning a routine dependency into a customer-facing outage risk until affected artifacts are rebuilt and redeployed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to
Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
Exploit-DB