CVE-2026-100662

Name of the Vulnerable Software and Affected Versions Netty HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final

Description An uncontrolled resource consumption issue exists in the QPACK encoder-stream instruction decoder within the QpackEncoderHandler (installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler allows an attacker to declare a string-literal length up to Integer.MAX VALUE (~2 GiB) for the Name Length and Value Length fields of the "Insert With Literal Name" instruction, without applying per-instruction length caps, cumulation-size limits, or standard HTTP/3 limits such as maxHeaderListSize, maxUnknownFramePayloadLength, or DEFAULT MAX FIELD SECTION SIZE. A remote, unauthenticated peer with an established HTTP/3 connection can declare a very large literal length and send fewer bytes than declared. This causes the ByteToMessageDecoder MERGE cumulator to grow the per-connection buffer and trigger a large byte-array allocation, leading to unbounded heap growth, OutOfMemoryError, and a denial of service.

Recommendations Update to version 4.2.18.Final.