High priorityDisclosed

Advisory · CVE-2026-100660

Netty HTTP/3 QPACK encoder keeps peer-controlled state forever

Netty's HTTP/3 codec retains unbounded per-stream QPACK encoder state keyed by the peer-controlled QUIC stream ID, released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation. A remote, unauthenticated HTTP/3 client that advertises a non-zero dynamic-table capacity and omits the mandatory acknowledgments can grow heap without bound over a single connection. Fixed in 4.2.18.Final.

Advisory published September 26, 2026Independent summary
Vendor
Netty
Product
Netty
Identifier / CWE
CVE-2026-100660
CWE-770
Action timing
Immediate
ELI5

Explain it like I’m five

The server keeps a souvenir for every conversation a visitor starts, and only throws them away when the visitor says so. The visitor never says so, so the souvenirs pile up until the server collapses.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01HTTP/3 handshake

    The attacker opens a QUIC connection to the HTTP/3 endpoint and advertises a non-zero dynamic-table capacity.

  2. 02Indexed headers

    The attacker sends HEADERS with indexed dynamic-table representations on many streams.

  3. 03No acknowledgments

    The mandatory Section Acknowledgment or Stream Cancellation on the QPACK decoder stream is omitted.

  4. 04Heap growth

    Per-stream encoder state keyed by peer-controlled stream IDs accumulates without bound until the JVM fails.

What happened

Netty’s HTTP/3 codec retains unbounded per-stream QPACK encoder state keyed by the peer-controlled QUIC stream ID, released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation (CVE-2026-100660, CVSS 8.7). A remote, unauthenticated HTTP/3 client that advertises a non-zero dynamic-table capacity can send HEADERS with indexed dynamic-table representations on many streams and simply omit the mandatory acknowledgments, growing heap without bound over a single connection until the JVM throws OutOfMemoryError. The issue is fixed in Netty 4.2.18.Final.

What to do

  1. Upgrade Netty to 4.2.18.Final if you serve HTTP/3.
  2. Monitor heap growth on HTTP/3 endpoints; a single long-lived connection driving unbounded growth is the signature.
  3. Limit connection lifetimes and concurrent streams per connection as defense in depth.

Management note

HTTP/3 stacks are still the new frontier for denial-of-service research, and QPACK state machines are where the bugs live. If you have enabled HTTP/3 on Netty, this one is a straightforward patch.