High priorityDisclosed

Advisory · CVE-2026-100661

Netty HTTP/3 QPACK decoder can be stalled into a quadratic memory blowup

Netty's HTTP/3 QPACK prefixed-integer decoder does not bound the number of continuation bytes it processes. A remote, unauthenticated peer can send an endless run of continuation bytes on a QPACK unidirectional stream; each decode re-scans the whole accumulated buffer, yielding quadratic CPU cost and unbounded heap growth. Fixed in 4.2.18.Final.

Advisory published September 26, 2026Independent summary
Vendor
Netty
Product
Netty
Identifier / CWE
CVE-2026-100661
CWE-400
Action timing
Immediate
ELI5

Explain it like I’m five

A clerk reading a form flips back to page one every time a new line arrives, and the sender keeps sending new lines forever. The clerk gets slower and slower while the pile of paper grows.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01QPACK stream

    The attacker opens the QPACK unidirectional stream of an HTTP/3 connection.

  2. 02Endless continuations

    The attacker sends an endless run of continuation bytes for a prefixed integer.

  3. 03Rescan on decode

    Each decode re-scans the entire accumulated buffer, so cost grows quadratically with input length.

  4. 04CPU and heap blowup

    CPU saturates while the buffer grows without bound, denying service.

What happened

Netty’s HTTP/3 QPACK prefixed-integer decoder does not bound the number of continuation bytes it processes (CVE-2026-100661, CVSS 8.7). A remote, unauthenticated peer can send an endless run of continuation bytes on a QPACK unidirectional stream; because each decode re-scans the whole accumulated buffer, CPU cost grows quadratically with input length while heap grows without bound. The issue is fixed in Netty 4.2.18.Final.

What to do

  1. Upgrade Netty to 4.2.18.Final if you serve HTTP/3.
  2. Watch for CPU saturation on HTTP/3 workers that does not correspond to real request volume.
  3. Cap QUIC stream data and connection lifetimes as defense in depth.

Management note

Algorithmic-complexity denial-of-service is the cheapest kind to exploit and the hardest to attribute. One patch closes this and the other QPACK flaws disclosed the same day, so take them together.