Netty HTTP/3 codec EUVD-2026-87754

Requires the target to run a Netty HTTP/3 server using netty-codec-http3 between 4.2.0.Final and 4.2.17.Final, with QPACK dynamic-table indexing in effect - i.e., the server must reuse a dynamically-indexed response header after the client advertises a non-zero QPACK dynamic-table capacity and acknowledges the insertion. Exploitation itself needs no authentication or user interaction (PR:N/UI:N) and is performed over a single QUIC connection, bypassing concurrent-stream limits by withholding mandatory Section Acknowledgments. The practical limiter is deployment scope: only Internet-facing HTTP/3 (QUIC) endpoints built on Netty are exposed, and HTTP/3 support on Netty is not yet widely enabled in production.

This is a genuine but bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, all confidentiality/integrity metrics N) is internally consistent with the description: a remote, unauthenticated attacker over the network triggers unbounded heap growth leading to memory-exhaustion DoS, with no data compromise. The vendor score of 8.7 is driven entirely by VA:H (high availability impact) combined with easy network reachability. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so the 8.7 reflects theoretical severity rather than demonstrated exploitation - treat it as a high-severity-but-unproven-in-the-wild issue. A meaningful real-world limiter not captured by the raw CVSS is that the target must be an HTTP/3 (QUIC) endpoint built on netty-codec-http3 AND must reuse dynamically-indexed QPACK response headers; HTTP/3 server deployment on Netty is still comparatively uncommon, which narrows the exposed population. No signals conflict; the main gap is the absence of exploitation-probability data (EPSS/KEV/POC all unstated).

An attacker opens a single QUIC/HTTP/3 connection to a Netty-based server, advertises a non-zero QPACK dynamic-table capacity, and acknowledges a table insertion so the server begins reusing a dynamically-indexed response header. The attacker then fires a rapid stream of sequential requests while deliberately withholding every mandatory QPACK Section Acknowledgment, causing the QpackEncoder to retain per-stream state indefinitely until the JVM heap is exhausted and the server crashes. No authentication or user interaction is required; no public exploit code is identified at time of analysis.