CVE-2026-100664

Executive Summary

CVE-2026-100664 is an authority-confusion vulnerability in Netty's HTTP/3 codec (io.netty:netty-codec-http3) affecting versions 4.2.2.Final through 4.2.17.Final. When converting an HTTP/1 message to HTTP/3 headers, the codec derives the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority present in an absolute-form request-target, violating the HTTP/1.1 requirement that a server receiving an absolute-form request-target must ignore Host. In Netty-based HTTP/1-to-HTTP/3 gateways, proxies, or protocol bridges, this allows a remote, unauthenticated client to make a front-end component (routing, authorization, allow-listing, cache keying, URL generation) and the downstream HTTP/3 peer reach conflicting decisions about the intended authority. The advisory reports integrity impact only — no code execution, memory corruption, or availability impact — with a CVSS base score of 7.5.

Technical Analysis

Netty's io.netty:netty-codec-http3 module performs HTTP/1-to-HTTP/3 translation through HttpConversionUtil.toHttp3Headers(HttpMessage, boolean), which is reached via Http3FrameToHttpObjectCodec(false). The core defect is an ordering/precedence error in how the :authority pseudo-header is populated:

• The method builds :authority from the HTTP/1 Host header before it considers the authority of an absolute-form HTTP/1 request-target (for example, GET https://trusted.example/admin HTTP/1.1).
• Because a non-empty Host header takes precedence, a request carrying both an absolute-form request-target and a conflicting Host header produces an HTTP/3 :authority derived from Host, not from the request-target.

This directly contradicts RFC 7230's rule that when a server receives an absolute-form request-target, it must ignore the Host header and use the request-target authority instead. The result is a parser/precedence differential (an "authority confusion" class issue, mapped to CWE-20 Improper Input Validation): two components in the same request path — the HTTP/1-facing front end and the HTTP/3-facing backend — can form different, attacker-controlled beliefs about which authority the request is directed at.

The attack surface is any Netty deployment that acts as a gateway, proxy, or protocol bridge terminating HTTP/1 on the client side and emitting HTTP/3 upstream (or otherwise passing the derived :authority downstream). Netty is a widely embedded JVM networking library, so the vulnerable code path is exposed wherever this specific conversion is enabled and reaches untrusted clients.

No public proof-of-concept, Nuclei template, or exploit code exists at the time of writing, and no vendor workaround is documented. The advisory scope is integrity-only: the flaw manipulates routing/authorization decisions but does not by itself yield code execution, memory corruption, or denial of service.

Exploitation Scenarios

The description provides a precise request-level mechanism, so the attack chain can be described concretely at the vulnerability-class level. No public PoC is available; the chain below is inferred directly from the documented precedence flaw.

1. Reconnaissance / target identification. The adversary identifies a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge that terminates client HTTP/1 traffic and forwards to an HTTP/3 peer. Such front ends are typically internet-facing, so an unauthenticated remote client can reach them directly.

2. Triggering the flaw. The adversary sends a single HTTP/1.1 request using an absolute-form request-target together with a conflicting Host header, e.g. GET https://trusted.example/admin HTTP/1.1 with Host: attacker.example. Because HttpConversionUtil.toHttp3Headers populates :authority from Host before considering the request-target authority, the emitted HTTP/3 request carries :authority: attacker.example even though the request-target names trusted.example.

3. Execution method (vulnerability class). This is an input-precedence / parser-differential abuse rather than code injection. The attacker supplies no special characters or exploit shellcode — only a well-formed HTTP/1 request whose two authority representations disagree. The flaw is triggered purely by the codec's header-derivation ordering.

4. Post-exploitation impact. Because the front end and the upstream HTTP/3 peer now disagree about authority, the attacker can attempt to influence virtual-host routing, bypass allow-list checks, redirect backend selection, poison cache keys, or manipulate generated URLs — steering a request destined for one authority toward processing as another. The advisory scopes this to integrity impact (CVSS I:H), with no confidentiality or availability impact, no code execution, and no memory corruption.

Impact Assessment

CVSS base score is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N):

• Attack Vector — Network: exploitable remotely over the network.
• Attack Complexity — Low: a single well-formed HTTP/1 request with mismatched authority triggers the defect; no special conditions or race are required.
• Privileges Required — None / User Interaction — None: any unauthenticated remote client can attempt it.
• Scope — Unchanged: impact is confined to the vulnerable component's security authority.
• Confidentiality — None: the flaw does not directly expose data.
• Integrity — High: routing, authorization, allow-list, cache-key, and URL-generation decisions can be manipulated.
• Availability — None.

Business impact centers on security-control bypass and request steering: in a gateway that enforces virtual-host routing, allow-lists, backend selection, or cache partitioning using the RFC-defined request-target authority, an attacker can cause those controls to evaluate a different authority than the one the HTTP/3 backend ultimately serves. Blast radius spans any Netty-based HTTP/1-to-HTTP/3 bridge in the affected version range, including those embedded in larger JVM applications. Because Netty is a common dependency, affected exposures may be indirect and not obvious from an asset inventory alone.

Detection Guidance

Sigma Rule

title: Netty HTTP/3 Authority Confusion via Host vs Absolute-Form Request-Target
id: 3f9c1a7e-6b2d-4e21-9a4c-1c0d5e7f8a90
status: experimental
description: Detects HTTP/1 requests carrying an absolute-form request-target whose Host header authority conflicts with the request-target authority, indicative of CVE-2026-100664 authority confusion against Netty HTTP/3 codec.
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - PUT
      - DELETE
      - HEAD
  selection_absform:
    cs-uri-stem|startswith:
      - 'http://'
      - 'https://'
  filter_internal:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '127.'
  condition: selection_method and selection_absform and not filter_internal
falsepositives:
  - Legitimate proxy clients that send absolute-form request-targets
level: high
tags:
  - attack.t1190
  - cve.2026-100664

YARA Rule

rule CVE_2026_100664_Netty_Authority_Confusion
{
    meta:
        description = "Detects HTTP/1 absolute-form request-targets with conflicting Host headers indicative of Netty HTTP/3 authority confusion (CVE-2026-100664)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100664"
        cve = "CVE-2026-100664"
        date = "2026-01-01"
    strings:
        $absform = /(GET|POST|PUT|DELETE|HEAD) https?:\/\/[^\r\n ]+ HTTP\/1\.[01]/
        $host = /Host: [^\r\n]+/
    condition:
        $absform and $host
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100664 Netty HTTP/3 Authority Confusion - absolute-form request-target with Host header"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"http"; startswith; pcre:"/^https?:\/\//"; http.header; content:"Host:"; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-100664; classtype:attempted-recon; sid:2026100664; rev:1;)

Elastic Detection

network where
  network.protocol == "http" and
  http.request.method in ("GET", "POST", "PUT", "DELETE", "HEAD") and
  http.request.uri : ("http://*", "https://*") and
  http.request.headers.host != null

Splunk SPL Query

index=web sourcetype=access_combined
| eval req_authority=if(match(uri, "(?i)^https?://"), mvindex(split(replace(uri,"^https?://",""),"/"),0), null())
| where isnotnull(req_authority) AND isnotnull(host_header) AND req_authority!=host_header
| stats count by src_ip, uri, host_header, req_authority
| where count >= 1

Wazuh OSSEC Rule

<group name="netty,web,cve-2026-100664,">
  <rule id="100664" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">^https?://</field>
    <regex offset="after_parent">Host:\s*(\S+)</regex>
    <description>CVE-2026-100664: Absolute-form request-target detected - possible Netty HTTP/3 authority confusion</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.web,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory states the issue is fixed in 4.2.18.Final, but no vendor patch has been independently confirmed from tracked sources; no vendor workaround is documented.

1. Immediate mitigations

   • Upgrade io.netty:netty-codec-http3 to 4.2.18.Final or later as the primary remediation, following normal dependency-change validation before broad rollout.
   • In the interim, harden HTTP/1 front ends to reject or normalize requests that mix an absolute-form request-target with a conflicting Host header, so the two authority representations cannot diverge before reaching the Netty conversion path.
   • Where feasible, disable or avoid the HTTP/1-to-HTTP/3 conversion path for untrusted client traffic until the fix is applied.
   • Apply strict allow-list validation on the request-target authority (not the Host header) at the edge, ensuring routing, authorization, and cache-key decisions use one authoritative source consistent with the HTTP/3 peer.

2. Patch / upgrade steps

   • Pin netty-codec-http3 (and the Netty BOM) to 4.2.18.Final or later.
   • Re-scan container images and embedded dependency trees (shaded/uber JARs) to confirm the fixed version is present everywhere Netty is bundled.
   • Re-test virtual-host routing, allow-list, backend selection, cache-key, and URL-generation behavior after upgrade.

3. Long-term hardening

   • Adopt a "single source of authority" rule in gateway code: always derive :authority from the request-target when absolute-form is used, ignoring Host, per RFC 7230.
   • Add regression tests that assert authority-precedence correctness at protocol-translation boundaries.
   • Maintain SBOM-driven dependency monitoring to catch transitively embedded Netty versions, and treat protocol-translation components as high-trust boundaries requiring differential-fuzzing coverage.

References

• NVD — CVE-2026-100664: https://nvd.nist.gov/vuln/detail/CVE-2026-100664
• Netty project (vendor): https://netty.io/
• Netty source/issue tracker for io.netty:netty-codec-http3: https://github.com/netty/netty
• RFC 7230, Section 5.4 (Host header and absolute-form request-target precedence): https://www.rfc-editor.org/rfc/rfc7230
• MITRE CWE-20 (Improper Input Validation): https://cwe.mitre.org/data/definitions/20.html

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-100664 at this time. CISA KEV: NO. No public PoC, Nuclei template, or exploit code is known. EPSS has not yet been scored by FIRST.org.