CVE-2026-100661 netty CVE debrief

Who should care

Defenders responsible for Netty-based applications, particularly those using HTTP/3 services, should assess their exposure and prioritize updates to mitigate this vulnerability. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for monitoring and defending these applications. They should review the vulnerability's impact on their systems, plan for updates or mitigates,

Why it matters

Defenders should care about CVE-2026-100661 because it allows remote, unauthenticated attackers to cause denial-of-service conditions in Netty-based applications using HTTP/3 services. The vulnerability can lead to significant performance degradation and potential outages. Defenders responsible for Netty-based applications should assess their exposure, prioritize updates to version 4.2.18.Final or later, and monitor for unusual QPACK stream activity.

• Unbounded per-connection heap growth (OutOfMemoryError)
• Event-loop CPU starvation leading to performance degradation
• Potential for denial-of-service attacks
• Need for verification of affected versions and exposure

Technical summary

The QPACK prefixed-integer decoder in Netty's HTTP/3 codec does not properly bound the number of continuation bytes it processes. A remote attacker can exploit this by sending a specially crafted sequence of bytes, leading to unbounded heap growth and CPU starvation. This issue affects Netty versions 4.2.0.Final through 4.2.17.Final, and defenders should prioritize updating to version 4.2.18.Final or later to mitigate this vulnerability. The vulnerability can lead to significant performance degradation and potential outages.

Defensive priority

Defenders should prioritize updating to version 4.2.18.Final or later to mitigate this vulnerability. They should also monitor for unusual QPACK stream activity and assess their exposure to HTTP/3 services.

Recommended defensive actions

• Update to Netty version 4.2.18.Final or later
• Monitor for unusual QPACK stream activity
• Assess exposure to HTTP/3 services
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Vendor advisories from Netty and Vulncheck offer additional context. Defenders should verify affected Netty versions, review QPACK stream activity, and assess exposure to HTTP/3 services. The vulnerability's impact is significant due to its potential for denial-of-service attacks, unbounded heap growth, and CPU starvation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.