High priorityDisclosed

Advisory · CVE-2026-100664

Netty HTTP/3 gateway trusts the Host header over the absolute request-target

Netty's HTTP/3 codec builds the :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form request-target, contrary to the HTTP/1.1 rule that the request-target authority must win. A remote client can send 'GET https://trusted.example/admin' with 'Host: attacker.example' so authorization and routing decisions split from what the upstream HTTP/3 peer receives. Fixed in 4.2.18.Final.

Advisory published September 26, 2026Independent summary
Vendor
Netty
Product
Netty
Identifier / CWE
CVE-2026-100664
CWE-20
Action timing
Immediate
ELI5

Explain it like I’m five

Two bouncers are supposed to check the same invitation, but one reads the name on the envelope and the other reads the name inside. A forger who writes different names on each gets one bouncer's approval and the other's confusion.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Mismatched request

    The client sends an absolute-form request-target naming one authority with a Host header naming another.

  2. 02Wrong precedence

    Netty builds :authority from the Host header first, instead of letting the request-target authority win per HTTP/1.1.

  3. 03Decision split

    Authorization and routing decisions see a different authority than the upstream HTTP/3 peer receives.

  4. 04Smuggling

    The attacker routes or authorizes traffic the proxy would otherwise reject.

What happened

Netty’s HTTP/3 codec builds the :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form request-target, contrary to the HTTP/1.1 rule that the request-target authority must win (CVE-2026-100664, CVSS 8.7). A remote client can send an absolute-form request such as “GET https://trusted.example/admin” with “Host: attacker.example”, so authorization and routing decisions in one layer split from what the upstream HTTP/3 peer receives. The issue is fixed in Netty 4.2.18.Final.

What to do

  1. Upgrade Netty to 4.2.18.Final on HTTP/1-to-HTTP/3 gateways and proxies.
  2. Audit gateway logs for requests where the absolute request-target authority differed from the Host header.
  3. Reject requests with conflicting authority sources at the edge rather than relying on downstream layers to reconcile them.

Management note

Authority confusion is the quiet cousin of request smuggling: nothing crashes, so it rarely shows up in monitoring. Disclosed alongside the CONNECT mistranslation the same day, so patch once and check both.