CVE-2026-100660 netty CVE debrief

Who should care

Defenders responsible for systems using Netty's HTTP/3 codec should assess exposure and prioritize patching or mitigation. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response.

Why it matters

CVE-2026-100660 is a high-severity vulnerability in Netty's HTTP/3 codec that can lead to denial of service via unbounded heap growth. Defenders should prioritize patching or mitigating this vulnerability, especially in systems using Netty's HTTP/3 codec.

• Denial of service via unbounded heap growth
• Potential for memory exhaustion
• Need for patching or mitigation to prevent exploitation

Technical summary

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. A remote, unauthenticated HTTP/3 client can exploit this vulnerability by advertising a non-zero QPACK dynamic-table capacity, acknowledging table insertion, and then omitting Section Acknowledgments while issuing sequential requests over a single QUIC connection, bypassing concurrent-stream limits and causing unbounded heap growth until the server exhausts memory.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems using Netty's HTTP/3 codec.

Recommended defensive actions

• Patch Netty to version 4.2.18.Final or later
• Implement compensating controls to limit QUIC connections
• Monitor for suspicious HTTP/3 traffic
• Review system configurations for potential exposure
• Conduct vulnerability scans to identify affected systems
• Track changes to Netty's HTTP/3 codec for future updates
• Assess the need for additional security controls

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Defenders should verify the vulnerability's impact on their systems, especially those using Netty's HTTP/3 codec. Evidence is limited to public CVE and NVD information. No additional exploits or impacts are confirmed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.