CVE-2026-100659

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final

Description The HTTP/3 codec fails to enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field must carry the same value when both are present. A remote unauthenticated peer can send a single HEADERS frame containing both fields with differing, attacker-controlled values. The request is accepted and delivered to the application with two conflicting authorities, which can allow the bypass of routing, virtual-host, and access-control decisions if different components in the request path consult different fields.

Recommendations Update netty-codec-http3 to version 4.2.18.Final.