The vulnerability in Netty's HTTP/3 codec involves the QpackEncoder retaining unbounded state per QUIC stream, keyed by the peer-controlled stream ID. The encoder stores a queue and dynamic-table index tracker for each encoded field section referencing the QPACK dynamic table. These entries are only released upon receiving a Section Acknowledgment or Stream Cancellation from the remote decoder, not when the HTTP/3 stream completes. A remote unauthenticated client can exploit this by advertising a non-zero QPACK dynamic-table capacity, acknowledging table insertions to reuse dynamically indexed headers, but omitting mandatory Section Acknowledgments while issuing sequential requests over a single QUIC connection. This bypasses concurrent-stream limits and causes unbounded heap growth, leading to server memory exhaustion and denial of service. The vulnerability is fixed in Netty version 4.2.18.Final.

A remote unauthenticated attacker can cause unbounded heap growth on the server by exploiting the unbounded retention of QPACK encoder state per stream. This leads to denial of service due to memory exhaustion. The vulnerability does not impact confidentiality or integrity but has a high impact on availability.

Upgrade to Netty version 4.2.18.Final or later, where this vulnerability is fixed. No other mitigation is indicated or required.