Prior to 4.2.16.Final, Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without… (CVE-2026-56816)

The vulnerability in Netty's Http3FrameCodec (io.netty:netty-codec-http3) arises because it reads the payload length of HTTP/3 reserved frame types directly from the wire without enforcing a maximum limit. An attacker can specify a payload length up to Integer.MAX_VALUE, causing the server to allocate excessive memory buffers. This lack of validation leads to memory exhaustion and denial of service. The issue affects versions prior to 4.2.16.Final and several specific older versions listed. The CVSS 3.1 score is 7.5, indicating a medium severity denial of service vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

An attacker can cause the affected Netty server to consume excessive memory by sending HTTP/3 reserved frames with very large payload lengths. This memory exhaustion can lead to denial of service, disrupting availability of services relying on Netty's HTTP/3 codec. There is no impact on confidentiality or integrity reported.

A fix is available in Netty version 4.2.16.Final. Users should upgrade to this version or later to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version boundary in the affectedVersions field.