The vulnerability occurs in the QPACK decoder component of Netty's HTTP/3 implementation. When decoding header blocks, the non-Huffman branch of the QpackDecoder's decodeHuffmanEncodedLiteral method may allocate a byte array of a length derived from the wire data before checking if that many bytes are available. This lack of validation allows a maliciously crafted small header to specify an extremely large length (on the order of a gigabyte), causing the server to allocate excessive memory and potentially crash or become unresponsive. A proof-of-concept demonstrates how a small HTTP/3 HEADERS frame can trigger this behavior.

This vulnerability can lead to a denial-of-service (DoS) condition by exhausting server memory resources through unbounded allocation. There is no indication of confidentiality or integrity impact. The attack requires sending a specially crafted HTTP/3 header frame to a vulnerable server using Netty's HTTP/3 codec.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should monitor vendor channels for updates. No vendor advisory or patch links are currently provided. Until a fix is available, consider mitigating exposure by limiting access to services using this component or applying network-level protections to block suspicious HTTP/3 traffic.