CVE-2026-100661 in Netty
Summary
by MITRE • 09/26/2026
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within Netty's HTTP/3 codec module, specifically affecting versions from 4.2.0.Final through 4.2.17.Final, represents a critical denial-of-service flaw rooted in the implementation of the QPACK prefixed-integer decoder. This component is responsible for parsing integer values encoded using variable-length prefix encoding schemes defined by the HTTP/3 specification. The core technical deficiency lies in the lack of bounds checking on the number of continuation bytes processed during decoding operations. In standard QPACK implementations, integers are encoded such that if a byte indicates more data follows via its most significant bits, subsequent bytes containing only the high bit set signal continuation. However, the vulnerable implementation fails to enforce a maximum limit on how many of these continuation bytes it will attempt to process before determining whether the integer value is complete or invalid.
An attacker can exploit this flaw by establishing an unauthenticated connection and opening a QPACK unidirectional stream with type 0x02 for encoder instructions or 0x03 for decoder instructions. By transmitting a first byte where all prefix bits are set, such as 0xFF for a seven-bit prefix or 0x3F for a five-bit prefix, the attacker signals that additional bytes follow to complete the integer value. Following this initial byte, the attacker sends an endless sequence of continuation bytes with the high bit set, typically represented as 0x80. Because each subsequent byte indicates more data is expected, and there is no upper bound on the number of such bytes accepted by the decoder logic, the system enters a state where it continuously attempts to accumulate input without ever reaching a valid termination condition for the integer parsing routine.
The operational impact of this vulnerability manifests through two primary mechanisms: unbounded memory consumption and severe CPU starvation. When the QPACK decoder encounters an incomplete sequence due to missing terminating bytes or invalid structures, it returns -1 to indicate that more bytes are needed. In Netty's architecture, this return value causes the ByteToMessageDecoder cumulator to retain the received data in its internal buffer rather than discarding it as malformed input immediately. As the attacker continues to send continuation bytes, the cumulative buffer grows without bound, eventually leading to an OutOfMemoryError that crashes the application or forces a restart. Simultaneously, each invocation of the decode method re-scans the entire accumulated buffer from the beginning to determine if enough data has arrived to form a valid integer. This results in quadratic O(N^2) CPU complexity relative to the size of the buffered input, causing event-loop threads to become starved and unable to process legitimate traffic or other connections effectively.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, specifically focusing on memory exhaustion and processor utilization limits. From a threat modeling perspective consistent with MITRE ATT&CK techniques, this behavior corresponds to T1498 Network Denial of Service, particularly the sub-category involving network flooding or protocol-level abuse that leads to service degradation. The attack is remote and requires no authentication, making it highly accessible for malicious actors seeking to disrupt services relying on Netty's HTTP/3 implementation. The quadratic scaling factor exacerbates the impact significantly compared to linear memory exhaustion attacks, as even moderate amounts of injected data can rapidly consume substantial CPU resources across multiple event loops in a high-concurrency environment.
Mitigation strategies primarily involve upgrading the Netty dependency to version 4.2.18.Final or later, where this logic has been corrected to enforce strict limits on continuation byte processing and prevent unbounded buffer growth. For organizations unable to upgrade immediately due to compatibility constraints, implementing network-level rate limiting or connection throttling can help mitigate the impact by restricting the volume of data a single peer can inject into QPACK streams within a given timeframe. Additionally, configuring Netty's ByteToMessageDecoder with appropriate maxCumulationBufferConstraints settings may provide some protection against excessive memory allocation, although this does not fully address the CPU starvation caused by the O(N^2) decoding loop. Security teams should also monitor for anomalous patterns in HTTP/3 traffic characterized by unusually long QPACK header blocks or streams that remain open without sending complete frame sequences, as these may indicate active exploitation attempts against unpatched systems.