CVE-2026-100663 netty CVE debrief

Who should care

Defenders of Netty-based HTTP/1-to-HTTP-3 proxies or gateways should assess exposure and prioritize upgrading to version 4.2.18.Final. Operators of affected systems should verify exposure, review security controls, and plan for remediation. Security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-100663 allows a remote client to bypass security controls in Netty-based HTTP/1-to-HTTP-3 proxies or gateways. Defenders should verify exposure and upgrade to version 4.2.18.Final.

• Bypassing tunnel allow-lists and egress policy
• Compromising backend selection and audit controls
• Potential for attacker-controlled tunnel :authority
• Verification of exposure and remediation priority

Technical summary

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. This can lead to a malformed HTTP/3 CONNECT whose tunnel :authority is attacker-controlled. The issue allows a remote client to bypass security controls in Netty-based HTTP/1-to-HTTP-3 proxies or gateways. The vulnerability is fixed in Netty version 4.2.18.Final, which correctly handles HTTP/1 CONNECT requests.

Defensive priority

Defenders should prioritize verifying exposure of Netty-based HTTP/1-to-HTTP/3 proxies or gateways and upgrading to version 4.2.18.Final.

Recommended defensive actions

• Verify exposure of Netty-based HTTP/1-to-HTTP-3 proxies or gateways
• Upgrade to Netty version 4.2.18.Final
• Review tunnel allow-lists, egress policy, backend selection, and audit controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but limited information is available on exploitation or affected systems. Defenders should verify exposure and review tunnel allow-lists, egress policy, backend selection, and audit controls. The issue is fixed in Netty version 4.2.18.Final. Limited source information is available on affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.