Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form… (CVE-2026-100663)
Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly handle HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3. This results in malformed HTTP/3 CONNECT requests where the tunnel :authority can be attacker-controlled, potentially bypassing tunnel allow-lists, egress policies, backend selection, or audit controls. The issue is fixed in version 4.2.18.Final.
AI Analysis
Technical Summary
The vulnerability in Netty's HTTP/3 codec (io.netty:netty-codec-http3) affects versions from 4.2.2.Final through 4.2.17.Final. The codec does not properly special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 headers in HttpConversionUtil.toHttp3Headers. Specifically, the authority-form target is parsed as a URI, causing the host to be emitted as :scheme, the :path to be set to "/", and the HTTP/1 Host header to be used as :authority. If the Host header is missing, the CONNECT target is dropped. This allows a remote client to send a CONNECT request with a Host header differing from the request-target, producing a malformed HTTP/3 CONNECT request with an attacker-controlled tunnel :authority. This can circumvent tunnel allow-lists, egress policies, backend selection, or audit controls that validate the HTTP/1 CONNECT request-target before forwarding over HTTP/3. The vulnerability is fixed in Netty version 4.2.18.Final.
Potential Impact
An attacker can manipulate the HTTP/3 CONNECT tunnel :authority by sending a CONNECT request with a mismatched Host header, potentially bypassing security controls such as tunnel allow-lists, egress policies, backend selection, or audit mechanisms that rely on validating the HTTP/1 CONNECT request-target. This could lead to unauthorized access or traffic forwarding through the proxy or gateway.
Mitigation Recommendations
Upgrade Netty's HTTP/3 codec to version 4.2.18.Final or later, where this issue is fixed. No other mitigation is indicated or required according to the available information.
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form… (CVE-2026-100663)
Description
Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly handle HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3. This results in malformed HTTP/3 CONNECT requests where the tunnel :authority can be attacker-controlled, potentially bypassing tunnel allow-lists, egress policies, backend selection, or audit controls. The issue is fixed in version 4.2.18.Final.
CVSS v3.1
Score 7.5high
Affected software
pkg:maven/io.netty/netty-codec-http3Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Netty's HTTP/3 codec (io.netty:netty-codec-http3) affects versions from 4.2.2.Final through 4.2.17.Final. The codec does not properly special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 headers in HttpConversionUtil.toHttp3Headers. Specifically, the authority-form target is parsed as a URI, causing the host to be emitted as :scheme, the :path to be set to "/", and the HTTP/1 Host header to be used as :authority. If the Host header is missing, the CONNECT target is dropped. This allows a remote client to send a CONNECT request with a Host header differing from the request-target, producing a malformed HTTP/3 CONNECT request with an attacker-controlled tunnel :authority. This can circumvent tunnel allow-lists, egress policies, backend selection, or audit controls that validate the HTTP/1 CONNECT request-target before forwarding over HTTP/3. The vulnerability is fixed in Netty version 4.2.18.Final.
Potential Impact
An attacker can manipulate the HTTP/3 CONNECT tunnel :authority by sending a CONNECT request with a mismatched Host header, potentially bypassing security controls such as tunnel allow-lists, egress policies, backend selection, or audit mechanisms that rely on validating the HTTP/1 CONNECT request-target. This could lead to unauthorized access or traffic forwarding through the proxy or gateway.
Mitigation Recommendations
Upgrade Netty's HTTP/3 codec to version 4.2.18.Final or later, where this issue is fixed. No other mitigation is indicated or required according to the available information.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qmrm-mg2w-2mpw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100663"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ab89be0f7a7c54106942059
Added to database: 09/27/2026, 04:30:24 UTC
Last enriched: 09/27/2026, 04:43:33 UTC
Last updated: 09/28/2026, 01:47:40 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.