CVE-2026-100662

Executive Summary

CVE-2026-100662 is an uncontrolled resource consumption vulnerability (CWE-400) in Netty's HTTP/3 codec (io.netty:netty-codec-http3), affecting versions 4.2.0.Final through 4.2.17.Final. A remote, unauthenticated attacker with an established HTTP/3 connection can exhaust server heap memory and trigger an OutOfMemoryError by abusing the QPACK encoder-stream instruction decoder. The vulnerability carries a CVSS 3.1 base score of 7.5 (High), with the entirety of the impact falling on availability.

Technical Analysis

The flaw resides in the QPACK encoder-stream instruction decoder implemented by QpackEncoderHandler, which is installed on the peer-initiated unidirectional QPACK encoder stream (stream type 0x02) as defined by RFC 9204. QPACK is the header compression format used by HTTP/3, and the encoder stream carries instructions that dynamically update the decoder's field table. One such instruction, "Insert With Literal Name" (RFC 9204 §4.3.3), encodes a name literal followed by a value literal, each prefixed by a length field.

The QpackEncoderHandler in the affected Netty versions accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of this instruction. Critically, there is no per-instruction length cap and no cumulative size limit enforced by the handler. The existing HTTP/3 protective limits — maxHeaderListSize, maxUnknownFramePayloadLength, and DEFAULT_MAX_FIELD_SECTION_SIZE — are not applied to this handler, leaving it isolated from the codec's normal resource-governance controls.

The exploitation primitive is straightforward: the attacker declares a very large literal length within the instruction, then trickles fewer bytes than declared. Because the declared length is far larger than the bytes actually supplied, the ByteToMessageDecoder MERGE cumulator retains and grows the per-connection buffer while waiting for the remaining declared bytes. Depending on how the decoder progresses, this also drives a large byte-array allocation sized according to the attacker-controlled length declaration. The result is unbounded per-connection heap growth, culminating in OutOfMemoryError and denial of service for the affected JVM.

The attack surface is any Netty-based HTTP/3 server running a default configuration in the affected version range. Because the encoder stream is peer-initiated and unidirectional, the attacker does not require any prior authentication or privileged state — a single established HTTP/3 connection is sufficient. The fix landed in 4.2.18.Final; no further implementation-level detail is available from the provided data.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-100662, and no Nuclei template or OSV package mapping has been published. The attack chain below is therefore described at the vulnerability-class level, inferred strictly from the NVD description. All named artifacts (QpackEncoderHandler, stream type 0x02, "Insert With Literal Name", Integer.MAX_VALUE, the MERGE cumulator, and the named HTTP/3 limit parameters) are drawn verbatim from that description.

1. Reconnaissance / target identification. The attacker identifies a target running a Netty-based HTTP/3 server within the affected version range (4.2.0.Final through 4.2.17.Final). HTTP/3 servers are typically exposed on UDP port 443 using QUIC; Netty is a widely embedded Java network application framework, so the vulnerable codec may be present in downstream applications that do not advertise the framework by name. Version fingerprinting of the HTTP/3 / QUIC stack or observation of Netty-specific behaviors can confirm exposure.

2. Triggering the flaw class. The attacker completes the QUIC handshake and establishes an HTTP/3 connection, then opens the peer-initiated unidirectional QPACK encoder stream (stream type 0x02). On that stream, the attacker sends a QPACK "Insert With Literal Name" instruction (RFC 9204 §4.3.3) in which the Name Length and/or Value Length field declares a length of up to Integer.MAX_VALUE. The handler does not reject or clamp this declared length because no per-instruction cap, per-literal cap, or cumulative-size limit is applied, and the HTTP/3-level limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) do not govern this handler.

3. Payload / execution method. Rather than supplying the declared number of literal bytes, the attacker trickles fewer bytes than declared and holds the connection open. The ByteToMessageDecoder MERGE cumulator then retains and grows the per-connection decode buffer as it waits for the balance of the declared literal, and a large byte-array allocation is triggered based on the declared length. This is a protocol-conformant-stream-abuse denial-of-service pattern: no memory-corruption primitive is required, only the disparity between the declared length and the bytes actually sent.

4. Post-exploitation impact. The per-connection buffer growth is unbounded, so heap consumption climbs toward the JVM limit. Repeated or concurrent connections, or repeated instructions on a single connection, accelerate exhaustion. Once the JVM cannot satisfy further allocation, an OutOfMemoryError is thrown, degrading or terminating the affected service. Because the attack is remote and unauthenticated and requires only one established HTTP/3 connection, it can be executed at low cost by an external adversary.

Impact Assessment

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5 (High). The subscores map directly to the exploitation profile:

• Attack Vector (Network, AV:N): exploitable remotely over the network via the QUIC/HTTP/3 transport.
• Attack Complexity (Low, AC:L): no race condition, no special preconditions beyond an established HTTP/3 connection.
• Privileges Required (None, PR:N): the QPACK encoder stream is peer-initiated; no authentication is needed.
• User Interaction (None, UI:N): the victim server process is targeted directly; no operator action is required.
• Scope (Unchanged, S:U): impact is confined to the vulnerable service's security authority.
• Confidentiality (None, C:N) / Integrity (None, I:N): this is a pure availability issue — no data disclosure or modification is described.
• Availability (High, A:H): OutOfMemoryError can render the service unavailable.

Business impact. Any production service built on an affected Netty HTTP/3 stack is exposed to remote denial of service. Because Netty is a library embedded in downstream applications (proxies, API gateways, application servers, custom HTTP/3 services), the blast radius extends beyond direct Netty deployments to every product that bundles the affected version range. A successful single-connection attack can terminate or severely degrade a JVM-based service, causing service outage, request failures for legitimate clients, and potential cascading failures in dependent tiers. The default-configuration nature of the flaw means organizations cannot rely on existing limit tuning to be protected. EPSS has not yet been scored by FIRST.org, and CISA KEV listing is absent, indicating no confirmed exploitation in the wild at the time of writing.

Detection Guidance

Sigma Rule

title: Netty HTTP/3 QPACK Encoder-Stream Oversized Literal Denial of Service
id: 3f9c1a72-5d84-4e21-9b7a-2c6f0d1e8a44
status: experimental
description: Detects application log or JVM indicators consistent with exploitation of CVE-2026-100662, where an oversized QPACK literal length causes unbounded heap growth and OutOfMemoryError in io.netty:netty-codec-http3.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100662
author: valtersit.com
date: 2026-01-01
logsource:
  category: application
  product: java
detection:
  selection_oom:
    message|contains:
      - 'OutOfMemoryError'
  selection_netty:
    message|contains:
      - 'netty-codec-http3'
      - 'QpackEncoderHandler'
      - 'io.netty.handler.codec.http3'
  selection_heap:
    message|contains:
      - 'Java heap space'
      - 'Direct buffer memory'
  condition: selection_oom and (selection_netty or selection_heap)
falsepositives:
  - Legitimate memory pressure from unrelated workloads
  - Normal JVM garbage-collection or heap-sizing noise
level: high

YARA Rule

rule EXPL_CVE_2026_100662_Netty_HTTP3_QPACK_DoS
{
    meta:
        description = "Heuristic detection of Netty HTTP/3 QPACK encoder-stream resource-consumption indicators in logs or memory artifacts (CVE-2026-100662)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100662"
        date = "2026-01-01"
        severity = "high"

    strings:
        $netty = "netty-codec-http3" ascii wide nocase
        $qpack = "QpackEncoderHandler" ascii wide
        $http3 = "io.netty.handler.codec.http3" ascii wide
        $oom   = "OutOfMemoryError" ascii wide
        $heap  = "Java heap space" ascii wide
        $inslit = "Insert With Literal Name" ascii wide nocase

    condition:
        (uint16(0) == 0xCAFE or uint32(0) == 0x504B0304) and
        (($qpack and $oom) or ($netty and $heap) or ($http3 and ($qpack or $inslit)))
}

Suricata IDS Rule

alert udp any any -> any 443 (msg:"EXPLOIT CVE-2026-100662 Netty HTTP/3 QPACK oversized literal length DoS attempt"; flow:to_server; content:"|40|"; depth:0; dsize:>1300; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-dos; reference:cve,2026-100662; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100662; metadata:affected_product Netty, deployment Perimeter; sid:2026100662; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where destination.port == 443 and network.transport == "udp" and event.action == "connection_established"]
  [process where process.name : "java" and message : "*OutOfMemoryError*" and message : ("*netty-codec-http3*" or "*QpackEncoderHandler*" or "*Java heap space*")]

Splunk SPL Query

index=netty OR index=application (sourcetype=java OR sourcetype=netty)
| search ("OutOfMemoryError" OR "Java heap space") ("netty-codec-http3" OR "QpackEncoderHandler" OR "io.netty.handler.codec.http3")
| stats count AS oom_events, values(host) AS hosts, values(dest) AS services BY source, bin(_time, 1m)
| where oom_events >= 1
| sort - _time

Wazuh OSSEC Rule

<group name="netty,http3,cve-2026-100662,">
  <rule id="100662" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">OutOfMemoryError</field>
    <field name="message">netty-codec-http3|QpackEncoderHandler|io.netty.handler.codec.http3|Java heap space</field>
    <description>CVE-2026-100662: Possible Netty HTTP/3 QPACK encoder-stream resource-consumption denial of service (OutOfMemoryError in affected Netty HTTP/3 codec).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,cve_2026_100662,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, workaround, OSV package mapping, or affected-version array is present in the provided data; the NVD description states the issue is fixed in 4.2.18.Final.

1. Immediate mitigations (reduce exposure now):

• Treat all Netty-based HTTP/3 listeners in the 4.2.0.Final–4.2.17.Final range as exposed. If HTTP/3 is not a required service, disable the HTTP/3/QUIC listener entirely to remove the attack surface.
• Restrict network reachability of HTTP/3 endpoints (UDP 443) to trusted client ranges using firewall, security-group, or QUIC/UDP rate-limiting controls to reduce feasible connection volume from untrusted sources.
• Apply per-source connection and QUIC/HTTP/3 stream limits at the load balancer or edge, and enforce JVM heap ceilings (-Xmx) so that exhaustion is contained rather than propagated.
• Deploy monitoring (see Detection Guidance) for OutOfMemoryError, heap-growth spikes correlated with QPACK encoder-stream activity, and abnormal counts of peer-initiated unidirectional streams. Note that the HTTP/3-level limits named in the description are not applied to the vulnerable handler, so tuning those parameters alone is not a reliable mitigation.

2. Patch / upgrade steps:

• Upgrade io.netty:netty-codec-http3 — and the Netty distribution that embeds it — to 4.2.18.Final or later, which the NVD description identifies as the fixed version.
• Because Netty is commonly a transitive dependency, inventory downstream applications and rebuild/redeploy them against the fixed Netty release rather than patching only the top-level project manifest.
• Coordinate with vendors of any products that bundle Netty to confirm their fixed version; pin and verify dependency versions during the upgrade.
• Re-validate all HTTP/3 functionality after upgrading, and confirm the OOM condition no longer reproduces in a staging environment.

3. Long-term hardening:

• Adopt continuous software composition analysis (SCA) with alerting on Netty version drift, so transitive HTTP/3 codec dependencies are visible across the fleet.
• Impose defensive resource ceilings on all decoding paths: per-connection buffer caps, per-instruction literal length limits, and cumulative table-size limits, regardless of protocol-level limits.
• Standardize JVM heap limits and enable heap-dump capture on OutOfMemoryError so future resource-consumption incidents are diagnosable.
• Maintain an authoritative Netty upgrade cadence and test HTTP/3/QPACK interoperability as part of regular dependency hygiene.

References

• NVD — CVE-2026-100662: https://nvd.nist.gov/vuln/detail/CVE-2026-100662
• RFC 9204 — QPACK: Field Compression for HTTP/3 (see §4.3.3, "Insert With Literal Name"): https://www.rfc-editor.org/rfc/rfc9204
• Netty project / io.netty:netty-codec-http3 artifact (upgrade target: 4.2.18.Final): https://netty.io/
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-100662 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-100662. There is no evidence of active exploitation in the wild, and no threat-actor campaign has been associated with this CVE in the provided data. EPSS has not yet been scored by FIRST.org.