EUVD-2026-87756
GHSA-w648-8654-gr82
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconOpen HTTP/3 connection to server
-
DeliveryOpen QPACK encoder stream (0x02)
-
ExploitSend Insert-With-Literal-Name, huge declared length
-
InstallTrickle fewer bytes than declared
-
C2Cumulator retains and grows buffer
-
ExecuteLarge allocation triggers OutOfMemoryError
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target to be running a Netty HTTP/3 server using the netty-codec-http3 module (versions 4.2.0.Final-4.2.17.Final) with the default QpackEncoderHandler installed on the peer-initiated unidirectional QPACK encoder stream (type 0x02); no non-default configuration is needed once HTTP/3 is enabled. The attacker only needs an established HTTP/3 connection - no authentication (PR:N), no user interaction (UI:N). The primary limiting factor is deployment exposure: Netty's HTTP/3 codec is a newer, opt-in module, so only services that explicitly adopt Netty HTTP/3 are affected, not all Netty users. Existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) do not mitigate this handler. |
| Impact | This is a genuine, cleanly-scoped availability issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction, and impact is availability-only (VA:H; VC:N/VI:N) - consistent with the CWE-400 memory-exhaustion DoS described. The vendor 8.7 is driven entirely by the VA:H availability metric; there is no confidentiality or integrity impact, so this is not a code-execution or data-exposure threat. EPSS is not provided, KEV status is NO, and no POC is referenced - so signals point to a credible but not-yet-weaponized issue: 'no public exploit identified at time of analysis.' The one caveat tempering real-world risk is exposure: exploitation requires the target to actually run the Netty HTTP/3 codec (netty-codec-http3), an opt-in, relatively new module rather than default Netty usage - so raw CVSS network-reachability overstates the practical attack surface. Net: a real, patch-worthy DoS for anyone running Netty HTTP/3 servers, but lower urgency than the 8.7 suggests given availability-only impact and no exploitation evidence. |
| Exploit ScenarioDerived | An attacker establishes a normal HTTP/3 (QUIC) connection to a public Netty HTTP/3 server, opens the peer-initiated unidirectional QPACK encoder stream (type 0x02), and sends an 'Insert With Literal Name' instruction declaring a Name/Value length near Integer.MAX_VALUE (~2 GiB). By then trickling fewer bytes than declared, the ByteToMessageDecoder MERGE cumulator retains and grows the per-connection buffer and eventually attempts a huge byte-array allocation, driving the JVM to OutOfMemoryError. No authentication or user interaction is needed and no public exploit code is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Unbounded per-connection heap growth in Netty's HTTP/3 codec (io.netty:netty-codec-http3 4.2.0.Final-4.2.17.Final) allows an unauthenticated remote peer holding an established HTTP/3 connection to exhaust server memory and trigger OutOfMemoryError, resulting in denial of service. The QPACK encoder-stream handler (QpackEncoderHandler, installed by default on the peer-initiated unidirectional encoder stream, type 0x02) accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the 'Insert With Literal Name' instruction, then retains and grows the per-connection decode buffer while the peer trickles fewer bytes than declared; existing HTTP/3 limits such as maxHeaderListSize, maxUnknownFramePayloadLength, and DEFAULT_MAX_FIELD_SECTION_SIZE are not applied to this handler and provide no mitigation. Netty 4.2.18.Final resolves the issue, and no public exploit code was identified at time of analysis; the practical exposure is limited to services that have explicitly adopted Netty's opt-in HTTP/3 codec.
RemediationAI
Upgrade to Netty 4.2.18.Final - vendor-released patch: 4.2.18.Final - which is the first version that bounds the QPACK encoder-stream literal lengths; consult the GitHub advisory at https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w and the VulnCheck advisory at https://www.vulncheck.com/advisories/netty-http-3-qpack-encoder-stream-unbounded-memory-exhaustion-dos for the full release guidance. No vendor workaround is documented, and the standard HTTP/3 knobs (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) explicitly do not cover this handler, so they should not be relied upon as mitigations. If immediate upgrade is not possible, the most effective compensating control is to disable the HTTP/3 codec or the peer-initiated QPACK encoder stream entirely and serve clients over HTTP/2 or HTTP/1.1 until patched - the trade-off is loss of HTTP/3 capability for clients that require it. Alternatively, restrict network exposure of HTTP/3 endpoints to trusted peers or a hardened proxy/CDN that only relays well-formed QPACK traffic (trade-off: added architectural complexity and dependence on the front end's own robustness), cap concurrent connections per remote address to limit how many memory-amplifying streams an attacker can open simultaneously (trade-off: legitimate high-concurrency clients may be throttled), and set conservative JVM heap limits with memory monitoring so that exhaustion surfaces as a fast, isolated failure rather than host-wide instability (trade-off: lower per-node throughput headroom). These are interim measures only; patching to 4.2.18.Final is the definitive fix. Note that no public exploit code was identified at time of analysis, so prioritization should follow normal patch cycles for externally exposed HTTP/3 services.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Netty's HTTP/3 support layer, specifically the QPACK (RFC 9204) encoder-stream decoder. QPACK is HTTP/3's header-compression scheme, and each endpoint installs a peer-initiated unidirectional stream of type 0x02 through which the peer sends dynamic-table instructions. One such instruction, 'Insert With Literal Name' (RFC 9204 §4.3.3), carries a Name Length and a Value Length field; the decoder is expected to bound those fields against a configured maximum or otherwise cap cumulative dynamic-table growth. In the affected releases, QpackEncoderHandler imposes no per-instruction or per-literal length cap and no cumulation-size limit, so an attacker can declare a near-2 GiB literal length and then send data slowly or not at all. Because the decoder is a ByteToMessageDecoder using the MERGE cumulator, the partial instruction is retained and the per-connection cumulation buffer keeps growing, eventually forcing a large byte-array allocation and an OutOfMemoryError. This is a classic CWE-400 uncontrolled resource consumption pattern caused by missing input-size validation on the decompression/instruction-decode path, which is why the general HTTP/3 size limits do not help - they govern headers and unknown frames, not QPACK instruction operands. The CPE entry cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* reflects that the affected artifact is the netty-codec-http3 module distributed as part of the Netty project.
Know when Netty gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated peer with an established HTTP/3 connection triggers memory exhaustion with no complexity, so AV:N/AC:L/PR:N/UI:N; availability-only impact, no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the "Insert With Literal Name" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.
Articles & Coverage 1
Technical POC Analysis
The advisory assigns CWE-400 (with CWE-770 also listed).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Netty's HTTP/3 codec, versions 4.2.0.Final through 4.2.17.Final, contains a high-severity memory exhaustion flaw that can be triggered by a remote peer holding an HTTP/3 connection, leading to service unavailability. Organizations running internet-facing or internal services that rely on affected Netty HTTP/3 components should prioritize remediation because a single malicious connection can degrade or take down critical applications. A vendor patch is available in Netty 4.2.18.Final; no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to
Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
Exploit-DB