CVE-2026-100663

Executive Summary

CVE-2026-100663 is an input validation flaw (CWE-20) in Netty's HTTP/3 codec (io.netty:netty-codec-http3) affecting versions 4.2.2.Final through 4.2.17.Final. When a Netty-based HTTP/1-to-HTTP/3 proxy or gateway converts an HTTP/1 CONNECT request to HTTP/3, the authority-form request-target is incorrectly parsed as a URI, causing the host to populate the :scheme pseudo-header, :path to be set to "/", and the HTTP/1 Host header to populate :authority. Because these two values can diverge, a remote, unauthenticated client can craft a CONNECT request whose Host header names a different authority than the request-target, producing a malformed HTTP/3 CONNECT with an attacker-controlled tunnel :authority. This enables bypass of tunnel allow-lists, egress policy, backend selection, and audit controls. The CVSS v3.1 base score is 7.5 (High), reflecting network-exploitable, integrity-only impact with no authentication or user interaction required. No public PoC, exploit code, or Nuclei template is currently available.

Technical Analysis

The vulnerability resides in HttpConversionUtil.toHttp3Headers, the routine responsible for translating HTTP/1 messages into HTTP/3 pseudo-header representations. HTTP/1 CONNECT requests employ "authority-form" request-targets — a syntax in which the request-target itself carries the host:port of the tunnel destination (for example, CONNECT trusted.example:443). This is distinct from origin-form (GET /path) and absolute-form (GET http://host/path).

Per the NVD description, the codec fails to special-case authority-form targets during conversion. Instead, the authority-form target is parsed as a generic URI, which yields the following incorrect header mapping:

• The parsed "host" component of the CONNECT target is emitted as the HTTP/3 :scheme pseudo-header.
• The HTTP/3 :path pseudo-header is set to "/".
• The HTTP/1 Host header (if present) is used as the HTTP/3 :authority pseudo-header.
• If no Host header is present, the CONNECT target is dropped entirely.

The core defect is a semantic confusion between two distinct sources of truth for tunnel authority: the CONNECT request-target (which policy engines typically validate) and the Host header (which the HTTP/3 conversion trusts). Because the codec uses the Host header as :authority, an attacker who controls both fields can decouple the value seen by upstream HTTP/1-aware policy from the value propagated into the HTTP/3 tunnel. This is a classic parser differential / semantic mismatch, mapped to CWE-20 (Improper Input Validation).

The attack surface is any Netty-based proxy, gateway, or load balancer that (a) runs an affected version, (b) accepts inbound HTTP/1 CONNECT requests, and (c) converts and forwards them as HTTP/3. Direct Netty library consumers that do not perform HTTP/1-to-HTTP/3 CONNECT conversion are unaffected.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N indicates the flaw is remotely reachable with low complexity, requires no privileges or user interaction, and impacts only integrity — the integrity of routing, tunnel authorization, and audit records — while confidentiality and availability are rated as unaffected.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred at the vulnerability-class level from the NVD description. No specific function names, endpoint paths, or parameter values beyond those stated in the description are asserted.

1. Reconnaissance / Target Identification. The adversary identifies a Netty-based HTTP/1-to-HTTP/3 proxy or gateway running an affected version (4.2.2.Final–4.2.17.Final). This can be done through banner/library fingerprinting, response header analysis, or knowledge of the deployment's technology stack. The target must accept inbound HTTP/1 CONNECT and forward over HTTP/3.

2. Triggering the Flaw Class. The attacker sends an HTTP/1 CONNECT request in authority-form. Two fields are crafted to diverge: the CONNECT request-target names one authority (e.g., an allow-listed destination such as trusted.example:443), while the HTTP/1 Host header names a different, attacker-chosen authority. Because HttpConversionUtil.toHttp3Headers uses the Host header as :authority and the request-target host as :scheme, the resulting HTTP/3 CONNECT carries a tunnel :authority that does not match the validated request-target.

3. Payload / Execution Method (class level). The HTTP/1-aware policy layer validates the request-target against a tunnel allow-list or egress policy and approves it. The converted HTTP/3 message, however, presents the attacker-controlled :authority to the downstream HTTP/3 endpoint or backend selector. No memory corruption, code execution, or payload injection is involved — the "payload" is simply the mismatched header set.

4. Post-Exploitation Impact. Depending on the gateway's downstream behavior, the attacker may achieve: (a) bypass of tunnel allow-lists to reach otherwise-blocked authorities; (b) violation of egress policy; (c) redirection to a backend not intended for that CONNECT target (backend selection abuse); and (d) evasion of audit controls that log or validate the CONNECT request-target but not the resulting HTTP/3 :authority. This constitutes an integrity compromise of routing and policy enforcement. Note also the edge case where a missing Host header causes the CONNECT target to be dropped, which may yield availability-side side effects in some deployments, though CVSS rates availability as unaffected.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High). Subscore interpretation:

• Attack Vector (Network): exploitable remotely over the network.
• Attack Complexity (Low): no specialized conditions or race windows; a crafted request suffices.
• Privileges Required (None): no authentication needed.
• User Interaction (None): no victim action required.
• Scope (Unchanged): impact remains within the vulnerable component's security authority.
• Confidentiality (None): the flaw does not directly expose data.
• Integrity (High): tunnel authority, routing decisions, and audit records can be manipulated.
• Availability (None): no direct availability impact per the vector.

Business impact: Organizations using affected Netty versions in HTTP/1-to-HTTP/3 proxying paths face a policy-bypass risk. Egress filtering, tunnel allow-lists, backend routing rules, and compliance/audit logging may all be circumvented, undermining zero-trust egress controls and creating potential data-exfiltration or lateral-movement pathways via unauthorized tunnels. Blast radius is limited to deployments that perform HTTP/1-to-HTTP/3 CONNECT conversion; direct library consumers not performing this conversion are not exposed. Because the flaw is unpatched per tracked sources in the affected range (fix only in 4.2.18.Final), any un-upgraded deployment remains at risk.

Detection Guidance

Sigma Rule

title: Potential Netty HTTP/1 to HTTP/3 CONNECT Authority Mismatch (CVE-2026-100663)
id: 6f1c9d42-3b7a-4e21-9c88-nettyhttp3
status: experimental
description: Detects HTTP/1 CONNECT requests where the request-target authority differs from the Host header, indicating attempted bypass of Netty HTTP/3 tunnel validation.
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method: 'CONNECT'
  selection_target:
    cs-uri-stem|contains: ':'
  selection_host:
    cs-host: '*'
  filter_empty_host:
    cs-host: ''
  condition: selection_method and selection_target and selection_host and not filter_empty_host
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-host
falsepositives:
  - Legitimate proxies that align Host with CONNECT target
level: medium

YARA Rule

rule CVE_2026_100663_Netty_HTTP3_CONNECT
{
    meta:
        description = "Detects Netty HTTP/3 codec artifacts referencing CONNECT authority conversion"
        author = "Threat Intelligence"
        reference = "CVE-2026-100663"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "HttpConversionUtil"
        $b = "toHttp3Headers"
        $c = "netty-codec-http3"
        $d = "CONNECT "
        $e = ":authority"
        $f = ":scheme"
    condition:
        (uint16(0) == 0xCAFE or true) and
        (
            ($a and $b) or
            ($c and 2 of ($d, $e, $f))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100663 Netty HTTP/1-to-HTTP/3 CONNECT Authority Mismatch Attempt"; flow:established,to_server; http.method; content:"CONNECT"; http.header_names; content:"Host"; pcre:"/^CONNECT\s+[^\s\r\n]+/mi"; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:2026100663; rev:1;)

Elastic Detection

network where http.request.method == "CONNECT" and
  http.request.headers.Host != null and
  http.request.headers.Host != http.request.body.target

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=netty
| search method=CONNECT
| eval tunnel_target=mvindex(split(uri," "),1)
| where isnotnull(host_header) AND host_header != tunnel_target
| stats count values(host_header) values(tunnel_target) by src_ip, dest_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="netty,web,cve_2026_100663,">
  <rule id="100663" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>CONNECT</match>
    <regex offset="after_parent">CONNECT\s+([^\s]+)</regex>
    <description>CVE-2026-100663: Possible Netty HTTP/1-to-HTTP/3 CONNECT authority mismatch - tunnel target differs from Host header</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100663,proxy_policy_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (until upgrade is possible):

• Deploy an HTTP/1-aware reverse proxy or WAF in front of Netty-based gateways to reject CONNECT requests where the request-target authority does not exactly match the Host header, or where the Host header is absent.
• Enforce strict validation at the edge: require CONNECT authority-form targets and reject any request where Host is present and disagrees with the request-target.
• Disable HTTP/1-to-HTTP/3 CONNECT conversion in affected gateways where HTTP/3 tunneling is not operationally required.
• Log both the CONNECT request-target and the Host header at the ingress layer, and alert on divergence (see Detection Guidance).

2) Patch/upgrade steps:

• Upgrade io.netty:netty-codec-http3 to 4.2.18.Final, which the NVD description states fixes the issue.
• For consumers of the netty-codec-http3 artifact, update dependency management files (Maven/Gradle) and rebuild; verify the resolved version is 4.2.18.Final or later.
• Redeploy affected proxies/gateways and confirm the corrected conversion behavior in a staging environment before production rollout.

3) Long-term hardening:

• Adopt an "validate once, forward the same value" principle: ensure the exact authority validated by policy is the authority propagated into the HTTP/3 tunnel.
• Normalize semantic parsing across protocol versions to eliminate parser-differential classes of bugs.
• Maintain a software bill of materials (SBOM) and continuously monitor Netty dependency versions.
• Add regression tests covering authority-form CONNECT conversions and Host/request-target divergence.
• Monitor the Netty project and NVD for updated advisories, since this entry is currently unpatched per tracked sources.

References

• NVD — CVE-2026-100663: https://nvd.nist.gov/vuln/detail/CVE-2026-100663
• Netty Project — Official repository and release notes (netty/netty): https://github.com/netty/netty
• Netty Security Advisories: https://netty.io/news/ (verify 4.2.18.Final release advisory)
• MITRE CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been associated with CVE-2026-100663 at the time of writing. No public PoC, Nuclei template, or exploit code is available.