Threats affecting pkg:maven/io.netty/netty-codec-http3

Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final do not enforce the RFC 9114 requirement that the :authority pseudo-header and the literal host header, when both are present, must have the same value. This flaw allows a remote unauthenticated attacker to send a HEADERS frame with conflicting authority values, potentially bypassing routing, virtual-host, and access-control decisions. The issue is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder. The decoder does not limit the number of continuation bytes it processes, allowing a remote unauthenticated attacker to cause unbounded memory growth and CPU exhaustion. This results in OutOfMemoryError and event-loop CPU starvation. The issue is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions from 4.2.0.Final through 4.2.17.Final retain unbounded per-stream QPACK encoder state, which can cause unbounded heap growth and potential denial of service. The vulnerability is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly handle HTTP/1 CONNECT authority-form request-targets during conversion to HTTP/3. This flaw allows an attacker to control the tunnel :authority in HTTP/3 CONNECT requests, potentially bypassing tunnel allow-lists, egress policies, backend selection, or audit controls. The issue is resolved in version 4.2.18.Final.

Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final contain a vulnerability in the QPACK encoder-stream instruction decoder that allows an attacker to cause uncontrolled resource consumption. This can lead to unbounded heap growth and an OutOfMemoryError, resulting in denial of service. The issue is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly prioritize the HTTP/1 Host header over the authority in an absolute-form HTTP/1 request-target when building the HTTP/3 :authority pseudo-header. This violates HTTP/1.1 rules and can cause authority confusion in HTTP/1-to-HTTP/3 gateways or proxies, potentially leading to incorrect virtual-host routing, allow-list checks, backend selection, cache key usage, and URL generation. The vulnerability impacts data integrity but does not affect code execution or availability. The issue is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec (Http3FrameCodec) improperly trusts the payload length of reserved HTTP/3 frame types without enforcing any maximum size. An attacker can exploit this by sending reserved frames with very large payload lengths, causing the server to buffer excessive data in memory. This leads to memory exhaustion and a denial of service when multiple such streams are opened concurrently. The issue affects Netty versions prior to 4.2.16.Final and has been assigned CVE-2026-56816.

A vulnerability in Netty's HTTP/3 codec (netty-codec-http3) allows an attacker to cause unbounded memory allocation during QPACK header decoding. Specifically, the decoder may allocate a large byte array based on a length value from the wire without verifying that the data is actually present, enabling a denial-of-service condition due to excessive memory consumption.