CVE-2026-100660

Executive Summary

CVE-2026-100660 is an unbounded resource-consumption flaw (CWE-770) in Netty's HTTP/3 codec (io.netty:netty-codec-http3), affecting versions 4.2.0.Final through 4.2.17.Final. A remote, unauthenticated HTTP/3 client can force the server to retain per-stream QPACK encoder state that is never released when the HTTP/3 stream completes, leading to unbounded heap growth and eventual memory-exhaustion denial of service. Because the flaw is reachable over the network with no privileges or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, with A:H), any Internet-exposed or multi-tenant HTTP/3 service built on the affected Netty codec is at risk of full availability loss.

Technical Analysis

Netty's HTTP/3 codec ships a QPACK encoder implementation (QpackEncoder) used to compress response header field sections on behalf of the server. QPACK — the header-compression scheme mandated by HTTP/3 (RFC 9204) — supports a dynamic table whose insertions and evictions must be acknowledged by the peer's decoder through two instruction types: Section Acknowledgment (acknowledging a specific encoded field section) and Stream Cancellation (abandoning a stream). These acknowledgments govern when the encoder may safely evict dynamic-table entries and, in a correct implementation, release the associated bookkeeping.

Per the NVD description, the vulnerable versions retain unbounded per-stream QPACK encoder state. Specifically, QpackEncoder stores:

• a queue, and
• a dynamic-table index tracker

for every encoded field section that references the QPACK dynamic table, and these structures are keyed by the peer-controlled QUIC stream ID. Critically, the description states these entries are released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation instruction — not when the HTTP/3 stream completes. The result is a lifecycle mismatch: the local stream finishes, but the encoder-side state keyed to that stream persists on the heap indefinitely.

There is, according to the description, no limit on:

• the number of tracked streams,
• the number of tracked field sections, or
• the total retained bytes.

Because the stream ID key is attacker-controlled, and because acknowledgments are entirely voluntary from the peer's perspective, a malicious client can simply refuse to ever send the release-triggering instructions while continuing to open streams and solicit dynamically-indexed responses. The per-connection growth is monotonic and the attacker also "bypasses concurrent-stream limits," meaning the usual QUIC MAX_STREAMS-style backpressure does not bound the resource consumed — sequential requests over a single connection suffice.

The primitive the attacker needs is a non-zero advertised QPACK dynamic-table capacity plus acknowledgment of a table insertion such that the server reuses a dynamically indexed response header. That is: the very feature that makes QPACK dynamic-table compression effective (server reuses a dynamic entry across responses) is what causes the encoder to allocate per-stream tracking structures that the attacker then refuses to release.

Attack surface: any Netty-based HTTP/3 server that (a) has QPACK dynamic-table encoding enabled and (b) processes traffic from untrusted clients. This includes Java reverse proxies, API gateways, gRPC-over-HTTP/3 frontends, and application servers embedding Netty's HTTP/3 codec directly.

Root cause class: a resource-lifetime management defect — encoder state scoped to a peer-controlled identifier with release conditions controlled by the peer, and with no cap on tracked entries or bytes. This is the classic "acquire on request, release on peer action (which peer withholds)" denial-of-service anti-pattern, categorized under CWE-770 (Allocation of Resources Without Limits or Throttling).

Note on detail: the NVD description does not enumerate every internal data structure, method, or field name. Where the description is explicit — io.netty:netty-codec-http3, QpackEncoder, the queue and dynamic-table index tracker, Section Acknowledgment, Stream Cancellation, QUIC stream ID keying — those exact terms are used above. No additional method names or fields are asserted because the evidence does not support them.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the described vulnerability class (unbounded per-stream encoder state with peer-controlled release).

1. Reconnaissance / target identification. The attacker identifies a target running an HTTP/3 endpoint that uses the affected Netty codec versions (4.2.0.Final–4.2.17.Final). This is typically an Internet-exposed service advertising HTTP/3 via an Alt-Svc response header on its HTTP/1.1 or HTTP/2 endpoint, or a service reachable directly over UDP/443. The attacker needs no credentials and no prior foothold — an unauthenticated HTTP/3 client is sufficient.

2. Triggering the vulnerable state. The attacker establishes a QUIC connection and advertises a non-zero QPACK dynamic-table capacity in its SETTINGS. This signals to the server's QpackEncoder that dynamic-table encoding is permitted. The attacker then issues requests designed to cause the server to insert entries into the QPACK dynamic table and reuse a dynamically indexed response header, and it acknowledges the table insertion so the server considers the entry usable and continues to lean on dynamic indexing. From this point the QpackEncoder allocates a queue and dynamic-table index tracker keyed to each stream that references the dynamic table.

3. Execution method (withholding release). The attacker deliberately omits all mandatory Section Acknowledgment and Stream Cancellation instructions while issuing sequential requests over a single QUIC connection. Because release of the tracked encoder state is gated on those instructions — and not on HTTP/3 stream completion — the per-stream state remains resident even after each stream finishes. The attacker also bypasses concurrent-stream limits, so the usual mitigation of capping in-flight streams does not bound the accumulation. Repeating requests drives monotonic growth in tracked streams, tracked field sections, and retained bytes, with no ceiling enforced by the codec.

4. Post-exploitation impact (availability loss). Continued request generation causes unbounded heap growth. Eventually the server process exhausts memory (OutOfMemoryError in the JVM) or the host exhausts memory, resulting in process crash, request failures, and/or full service outage. This is a denial-of-service primitive: there is no confidentiality or integrity impact (CVSS C:N/I:N), only availability (A:H). Recovery requires restarting the affected service and, if the attacker continues, re-crashing it.

Because the entire chain is achievable over one connection and requires no authentication or user interaction, the effort-to-impact ratio strongly favors the attacker. Absent resource caps, the only reliable stop is patching or terminating the offending connections at an edge that understands QUIC/HTTP-3.

Note: no in-the-wild exploitation, weaponized PoC, or campaign linkage has been reported for this CVE as of the available data.

Impact Assessment

CVSS v3.1: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• AV:N — exploitable over the network; no local access required.
• AC:L — no special conditions; the attacker controls the necessary QPACK/client behavior by design.
• PR:N — no authentication required.
• UI:N — no victim user interaction; the service itself is the target.
• S:U — impact is confined to the vulnerable component.
• C:N / I:N — no confidentiality or integrity impact described.
• A:H — high availability impact: memory exhaustion can render the service fully unavailable.

Blast radius. Any service that (a) runs io.netty:netty-codec-http3 in the affected version window and (b) accepts HTTP/3 from untrusted or semi-trusted clients. In multi-tenant platforms, a single malicious tenant can degrade or crash the shared JVM/host, impacting all co-located tenants. In edge/CDN or gateway deployments, a modest number of malicious clients may be enough to exhaust a shared frontend, producing a broad outage.

Business impact. Denial of service against externally exposed web/API infrastructure; potential SLA violations; degradation or loss of service for legitimate clients; operational cost of repeated restarts and incident response; reputational damage for availability-sensitive services (finance, e-commerce, SaaS control planes). Because no credentials are needed, the flaw is also attractive for low-effort disruption by unsophisticated actors, not just advanced adversaries.

Affected systems. Java applications and services embedding Netty's HTTP/3 codec, including reverse proxies, API gateways, gRPC-over-HTTP/3 frontends, and application servers using HTTP/3 for inbound traffic.

Note: EPSS is not yet scored by FIRST.org and no CISA KEV listing exists; the practical exploitability is nevertheless high given the demonstrated attack preconditions. Do not use third-party EPSS figures.

Detection Guidance

Detection for this CVE is inherently behavioral: there is no payload string to match, only the abnormal QPACK/HTTP-3 behavior of a client that refuses to release encoder state. The rules below are heuristic and should be tuned to the environment.

Sigma Rule

title: Potential Netty HTTP/3 QPACK Unbounded State DoS (CVE-2026-100660)
id: 5f2c9e10-9c1a-4b7d-9e21-netty-http3-qpack
status: experimental
description: Detects a single QUIC/HTTP-3 client issuing many sequential requests
  on one connection without QPACK Section Acknowledgment/Stream Cancellation,
  consistent with CVE-2026-100660 state retention.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100660
author: threat-intel
date: 2026/01/01
logsource:
  category: application
  product: netty
detection:
  selection:
    event:
      - 'http3_request_received'
      - 'quic_stream_opened'
  condition: selection | count() by client_ip, connection_id > 1000
  timeframe: 10m
level: high

YARA Rule

rule CVE_2026_100660_Netty_HTTP3_QpackEncoder_State
{
    meta:
        description = "Heuristic detection of Netty HTTP/3 QPACK encoder state tracker references in memory/logs"
        cve = "CVE-2026-100660"
        severity = "high"
    strings:
        $pkg = "netty-codec-http3" ascii wide
        $enc = "QpackEncoder" ascii wide
        $dyn = "dynamic table" ascii wide nocase
        $sec = "Section Acknowledgment" ascii wide nocase
        $canc = "Stream Cancellation" ascii wide nocase
    condition:
        uint16(0) == 0xCAFE or
        ($pkg and $enc) or
        ($enc and ($dyn or $sec or $canc))
}

Suricata IDS Rule

alert quic any any -> any 443 (msg:"CVE-2026-100660 Netty HTTP/3 QPACK unbounded encoder state DoS attempt"; flow:to_server; \
  threshold: type both, track by_src, count 500, seconds 60; \
  classtype:attempted-dos; sid:2026100660; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.transport == "quic" and destination.port == 443]
  [network where network.transport == "quic" and destination.port == 443]
  [network where network.transport == "quic" and destination.port == 443]

Splunk SPL Query

index=network sourcetype=quic OR sourcetype=netty:http3
| where dest_port=443
| stats count AS reqs, dc(stream_id) AS streams, max(bytes_in) AS max_bytes
        BY src_ip, connection_id
| where reqs > 1000 AND streams > 200
| sort - reqs
| table src_ip, connection_id, reqs, streams, max_bytes

Wazuh OSSEC Rule

<group name="netty,http3,dos,">
  <rule id="100660" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">quic_stream_opened</field>
    <description>CVE-2026-100660 possible Netty HTTP/3 QPACK state exhaustion</description>
    <options>no_full_log</options>
    <frequency>500</frequency>
    <timeframe>60</timeframe>
    <same_source_ip />
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, no workarounds, and no fix were provided in the available data; the description states the issue is fixed in 4.2.18.Final, but this cannot be independently corroborated here and should be verified against upstream release notes before relying on it.

1. Immediate mitigations

   • Where possible, disable/deny inbound HTTP/3 and serve only HTTP/1.1 or HTTP/2 until an upgrade is available; if HTTP/3 is not required, remove support entirely.
   • If HTTP/3 must remain, terminate HTTP/3 at an edge/proxy that is not the affected Netty version and that enforces resource caps at the QUIC/HTTP-3 layer.
   • Apply connection and resource caps: limit concurrent QUIC connections per source, cap connections per backend worker, and impose per-connection request/stream-rate limits at the load balancer or QUIC termination point.
   • Add memory watchdog / JVM heap limits and automatic restart/health-check behavior to reduce outage duration when a process is targeted.
   • Monitor and alert on abrupt heap growth or OOM conditions correlated with HTTP/3 connection counts.
   • Because the NVD description notes the attacker "bypasses concurrent-stream limits," do not rely solely on stream-count limits; rate-limit requests per connection and per source IP as well.

2. Patch / upgrade steps

   • Verify current Netty version (io.netty:netty-codec-http3). If within 4.2.0.Final through 4.2.17.Final, plan remediation.
   • Upgrade to the version in which the issue is reported fixed (4.2.18.Final) after validating against upstream release notes and your dependency set (including transitive Netty dependencies).
   • Re-test under load to confirm the fix addresses the state-retention behavior and that no regression in HTTP/3 or QPACK handling is introduced.

3. Long-term hardening

   • Enforce bounded resource budgets at the network edge for all HTTP/3/QPACK consumers (caps on tracked streams, field sections, and retained bytes; connection/stream/rate limits).
   • Treat peer-controlled identifiers and peer-controlled acknowledgment flows as untrusted: any state whose release depends on remote instruction should have a hard upper bound and a timeout-based fallback release.
   • Maintain an SBOM/dependency inventory and CI checks to rapidly identify exposure to Netty (and other transport) advisories.
   • Adopt continuous dependency scanning and subscribe to upstream Netty release/advisory channels.
   • Include denial-of-service/availability scenarios in threat models for protocol-terminating edge components.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100660
• Netty project (upstream releases/advisories): https://github.com/netty/netty/releases
• Netty Maven coordinates: https://mvnrepository.com/artifact/io.netty/netty-codec-http3
• CWE-770 (Allocation of Resources Without Limits or Throttling): https://cwe.mitre.org/data/definitions/770.html
• HTTP/3 QPACK (RFC 9204): https://www.rfc-editor.org/rfc/rfc9204

No CISA KEV entry, no public PoC, no Nuclei template, and no reported in-the-wild exploitation or threat-actor campaign were identified in the available data for CVE-2026-100660.