CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
Remote attackers can cause denial of service in Netty HTTP/3 servers by exploiting unbounded memory allocation in the QPACK encoder stream handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100662?
CVE-2026-100662 is a high-severity denial of service vulnerability in netty, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the "Insert With Literal Name" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.
Weakness: CWE-400
Which versions are affected by CVE-2026-100662?
How do I fix CVE-2026-100662?
No fix has been published for CVE-2026-100662 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-100662 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100662 exists.
Sources
Also known as GHSA-f64r-x647-cg8w, GHSA-w648-8654-gr82, UBUNTU-CVE-2026-100662.