Threat Intelligence Database

Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly prioritize the HTTP/1 Host header over the authority in an absolute-form HTTP/1 request-target when building the HTTP/3 :authority pseudo-header. This behavior violates HTTP/1.1 rules and can cause authority confusion in Netty-based HTTP/1-to-HTTP/3 gateways or proxies. Such confusion may lead to incorrect virtual-host routing, allow-list checks, backend selection, cache key usage, and URL generation. The issue impacts data integrity but does not affect code execution or availability. The vulnerability is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final do not enforce the RFC 9114 requirement that the :authority pseudo-header and the literal host header, when both present, must have the same value. This allows a remote unauthenticated attacker to send a HEADERS frame with conflicting authority values, potentially bypassing routing, virtual-host, and access-control decisions. The issue is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final have a denial-of-service vulnerability in the QPACK prefixed-integer decoder. The decoder does not limit the number of continuation bytes it processes, allowing a remote unauthenticated attacker to cause unbounded memory growth and CPU exhaustion. This leads to OutOfMemoryError and event-loop CPU starvation. The vulnerability is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions from 4.2.0.Final through 4.2.17.Final have a vulnerability where unbounded per-stream QPACK encoder state is retained. This can lead to unbounded heap growth and potential denial of service. The issue is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec versions 4.2.2.Final through 4.2.17.Final improperly handle HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3. This results in malformed HTTP/3 CONNECT requests where the tunnel :authority can be attacker-controlled, potentially bypassing tunnel allow-lists, egress policies, backend selection, or audit controls. The issue is fixed in version 4.2.18.Final.

Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final have a vulnerability in the QPACK encoder-stream instruction decoder that allows an attacker to cause uncontrolled resource consumption. This can lead to unbounded heap growth and an OutOfMemoryError, resulting in denial of service. The issue is fixed in version 4.2.18.Final.