High priorityDisclosed

Advisory · CVE-2026-100662

Netty HTTP/3 QPACK encoder stream trusts a 2 GiB length declaration

Netty's HTTP/3 QPACK encoder-stream instruction decoder accepts an attacker-declared string-literal length of up to roughly 2 GiB with no per-instruction cap. A remote, unauthenticated peer that declares a huge literal length and trickles fewer bytes than declared makes the per-connection buffer grow without bound, ending in OutOfMemoryError. Fixed in 4.2.18.Final.

Advisory published September 26, 2026Independent summary
Vendor
Netty
Product
Netty
Identifier / CWE
CVE-2026-100662
CWE-400
Action timing
Immediate
ELI5

Explain it like I’m five

A delivery driver is told a package is the size of a house and starts reserving warehouse space for it, while the sender sends the house one brick at a time. The warehouse fills up with empty reserved space.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Huge declaration

    The attacker declares a QPACK string-literal length of up to roughly 2 GiB on the encoder stream.

  2. 02Trickle feed

    The attacker sends far fewer bytes than declared, keeping the instruction incomplete.

  3. 03Unbounded buffer

    The per-connection buffer grows to accommodate the declared length with no cap.

  4. 04Heap exhaustion

    The JVM throws OutOfMemoryError and the service dies.

What happened

Netty’s HTTP/3 QPACK encoder-stream instruction decoder accepts an attacker-declared string-literal length of up to roughly 2 GiB with no per-instruction cap (CVE-2026-100662, CVSS 8.7). A remote, unauthenticated peer declares a huge literal length and then trickles fewer bytes than declared, making the per-connection buffer grow without bound until the JVM throws OutOfMemoryError. The issue is fixed in Netty 4.2.18.Final.

What to do

  1. Upgrade Netty to 4.2.18.Final if you serve HTTP/3.
  2. Monitor heap growth on HTTP/3 endpoints with an eye on long-lived, low-throughput connections.
  3. Bound per-connection buffer growth and connection lifetimes as defense in depth.

Management note

Never trust a peer-declared length without a cap: this is the same class of bug that has bitten HTTP/2 HPACK, TLS record layers, and now QPACK. The patch adds the missing cap; make sure it is everywhere you run HTTP/3.