ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-100661

Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

CVSS 4.0 8.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-100661

Published

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-100661

Published

netty

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "netty",
                    "product": "netty",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:maven/io.netty/netty-codec-http3",
                    "versions": [
                        {
                            "version": "4.2.0.Final",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThan": "4.2.18.Final"
                        },
                        {
                            "version": "4.2.18.Final",
                            "status": "unaffected",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON