EUVD-2026-36459
GHSA-4grm-h2qv-h6w6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Netty service advertising HTTP/3 (Alt-Svc h3)
-
DeliveryOpen QUIC connection to UDP/443
-
ExploitRepeatedly open new request streams kept in blocked state
-
ExecutionCodec allocates unbounded blocked-stream state
-
PersistJVM heap exhausted, OutOfMemoryError thrown
-
ImpactNetty process crashes or stalls, service unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target service must have the Netty HTTP/3 codec (io.netty:netty-codec-http3) explicitly enabled and listening - HTTP/3 is not a default transport in Netty-based applications, so a server only serving HTTP/1.1 or HTTP/2 is not exposed. The attacker needs only network reachability to the QUIC/UDP listening port (typically UDP/443); no authentication, no user interaction, and no special client privileges are required, consistent with PR:N/UI:N in the CVSS vector. Limiting factors: the relatively narrow real-world deployment of HTTP/3 in Java/Netty stacks, any upstream QUIC connection or stream limits already enforced by the operator, and the fact that impact is availability-only (no data theft or code execution). |
| Impact | Signals are largely consistent and point to a real but specifically scoped DoS issue. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High) correctly captures network-reachable, unauthenticated, low-complexity availability-only impact - no confidentiality or integrity loss. EPSS is very low (0.05%, 17th percentile) and CISA KEV does not list this CVE, indicating no observed mass exploitation. No public exploit identified at time of analysis. The realistic priority is bounded by exposure: only services that have explicitly enabled the Netty HTTP/3 codec are reachable on this code path - HTTP/3 is opt-in and far less commonly deployed than HTTP/1.1 or HTTP/2, so many Netty users are not actually exposed despite using the same artifact. Conflict to note: the description says 'infinite number of blocked streams' but does not specify whether QUIC connection-level limits or a configured max-streams setting can blunt the attack - verify with the GHSA-4grm-h2qv-h6w6 advisory before relying on configuration as a mitigation. |
| Exploit ScenarioDerived | An attacker with network reachability to a public-facing Netty HTTP/3 endpoint opens a single QUIC connection and repeatedly initiates new request streams that the server places into a blocked state (e.g., by withholding required flow-control or QPACK dependency progress). Because the codec does not cap blocked-stream allocations, the server's JVM heap grows until an OutOfMemoryError crashes the process or makes it unresponsive, denying service to legitimate users. No public exploit has been identified at time of analysis, but the protocol-level nature of the trigger makes a working PoC straightforward for anyone familiar with QUIC tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote unauthenticated attackers to exhaust server memory by triggering creation of an unbounded number of blocked streams, leading to an OutOfMemoryError. The flaw affects any Java application or service using Netty as an HTTP/3 server. No public exploit identified at time of analysis, and EPSS probability is very low (0.05%, 17th percentile), but the network-reachable nature of the HTTP/3 protocol surface makes patching a priority for exposed endpoints.
RemediationAI
Vendor-released patch: upgrade io.netty:netty-codec-http3 (and aligned Netty modules) to 4.2.15.Final or later, per https://github.com/netty/netty/releases/tag/netty-4.2.15.Final and GHSA-4grm-h2qv-h6w6. If you cannot upgrade immediately, the most effective compensating control is to disable HTTP/3 on the Netty-backed endpoint and continue serving over HTTP/1.1 or HTTP/2 - the trade-off is loss of QUIC's lower-latency and 0-RTT benefits for clients that negotiated h3. Alternatively, place a non-Netty HTTP/3 terminator (e.g., a hardened reverse proxy or load balancer that does not share the bug) in front of the Netty service and have it speak HTTP/2 to the origin, accepting the added hop and operational complexity. Network-level filtering of UDP/443 to untrusted sources can reduce blast radius but breaks legitimate HTTP/3 clients on the public internet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Netty is a widely embedded asynchronous event-driven Java network framework used by many JVM-based servers, proxies, and microservice runtimes (e.g., Spring WebFlux, gRPC-Java, Vert.x, Elasticsearch). The vulnerability lives in the HTTP/3 codec, which transports HTTP semantics over QUIC and supports stream flow control. HTTP/3 streams may be 'blocked' (paused) waiting on flow-control credits or QPACK dynamic-table dependencies; the codec failed to bound how many such blocked streams a single connection could accumulate. This maps to CWE-770 (Allocation of Resources Without Limits or Throttling): the resource (stream state objects/buffers) is allocated per peer request with no cap, allowing linear growth of heap consumption until the JVM throws OOM and the process becomes unresponsive or terminates.
Know when Netty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated QUIC peer triggers unbounded allocation causing OOM; availability-only impact, no confidentiality or integrity loss, no user interaction.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.
Executive ViewAI
Netty's HTTP/3 codec (versions prior to 4.2.15.Final) contains a denial-of-service vulnerability allowing remote, unauthenticated attackers to exhaust server memory and trigger service outages. Organizations running Java applications with exposed HTTP/3 endpoints face immediate availability risk. No vendor-released patch identified at time of analysis, requiring immediate deployment of compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable HTTP/3 protocol on internet-exposed endpoints and fall back to HTTP/2 or HTTP/1.1 where operationally feasible; (2) implement strict per-connection stream count caps and total concurrent stream limits to bound memory consumption; (3) deploy rate limiting at network edge and application layer; (4) place HTTP/3 services behind load balancers with memory thresholds, connection timeouts, and graceful restart capability; (5) establish continuous monitoring for memory exhaustion patterns and availability anomalies; (6) establish upgrade readiness and apply Netty 4.2.15.Final immediately upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to
Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
Exploit-DB