VYPR
patchPublished Sep 26, 2026· Updated Sep 27, 2026· 1 source

Netty: Twelve Vulnerabilities Disclosed in HTTP/3, WebSocket, and STOMP Handlers

Key findings • Twelve vulnerabilities disclosed in Netty on September 26, 2026, affecting multiple codecs and handlers. • Several High severity vulnerabilities related to HTTP/3 and QPACK pro…

Key findings

  • Twelve vulnerabilities disclosed in Netty on September 26, 2026, affecting multiple codecs and handlers.
  • Several High severity vulnerabilities related to HTTP/3 and QPACK processing, potentially leading to DoS.
  • Issues identified in HTTP/1.1 pipelining, WebSocket, STOMP, and SPDY stream handling.
  • Affected versions span across Netty 4.1.x and 4.2.x series, requiring specific updates.
  • Vulnerabilities include resource exhaustion, incorrect header handling, and unverified hostname issues.

On September 26, 2026, a batch of twelve vulnerabilities was disclosed in the Netty Java-based asynchronous event-driven network application framework. The vulnerabilities, all disclosed on the same day, span multiple components including the HTTP/3 codec, HTTP codec, WebSocket handler, and STOMP codec, with several carrying High severity ratings. These issues collectively highlight potential risks in how Netty handles HTTP/3, HTTP/1.1 pipelining, WebSockets, and STOMP, with several leading to denial-of-service conditions or resource exhaustion.

A significant portion of the disclosed vulnerabilities, specifically CVE-2026-100664, CVE-2026-100663, CVE-2026-100662, CVE-2026-100661, CVE-2026-100660, and CVE-2026-10059, stem from issues within Netty's HTTP/3 codec (io.netty:netty-codec-http3). CVE-2026-100664 and CVE-2026-100663 detail how the codec incorrectly handles the :authority pseudo-header and absolute-form HTTP/1 request-targets when converting HTTP/1 messages to HTTP/3, potentially leading to security bypasses or misconfigurations. CVE-2026-100662 and CVE-2026-100661 point to denial-of-service vulnerabilities in the QPACK encoder-stream instruction decoder and prefixed-integer decoder, respectively, allowing remote peers to consume excessive resources. CVE-2026-100660 highlights an unbounded per-stream QPACK encoder state, which could be exploited for resource exhaustion. CVE-2026-100659, also related to HTTP/3, notes that the :authority pseudo-header field and a literal host header field are not enforced to carry the same value when both are present, deviating from RFC 9114.

Other vulnerabilities affect different Netty components. CVE-2026-100666, impacting HttpServerCodec, pairs outbound responses with inbound requests, potentially leading to issues with 1xx informational responses. CVE-2026-100665 addresses an incomplete hostname verification fix in the QUIC certificate verification path. CVE-2026-100658 describes an unbounded per-connection queue in WebSocketServerExtensionHandler, where an excessive number of inbound HTTPRequests can be queued without proper bounds. CVE-2026-100657 reveals a ByteBuf leak in the STOMP codec's StompSubframeDecoder, where a NUL byte termination is expected but not always handled correctly, leading to resource leaks. Finally, CVE-2026-100656, affecting HttpServerCodec, contains an unbounded per-connection queue growth flaw in tracking HTTP methods of unanswered pipelined requests. CVE-2026-100655 points out an unlimited number of concurrent remote-initiated SPDY streams due to an exposed default value in SpdySessionHandler.

The disclosed vulnerabilities affect various versions of Netty. For the HTTP/3 codec issues (CVE-2026-100664, CVE-2026-100663, CVE-2026-100662, CVE-2026-100661, CVE-2026-100660, CVE-2026-100659), affected versions range from 4.2.0.Final through 4.2.17.Final or 4.2.18.Final, depending on the specific CVE. CVE-2026-100666 affects versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final. CVE-2026-100656 affects versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final. CVE-2026-100655 affects versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final. CVE-2026-100657 affects versions up to and including 4.1.136.Final. CVE-2026-100665 affects versions from 4.2.11.Final before 4.2.18.Final. Specific patch versions are recommended for each vulnerability, with users advised to consult the official Netty advisories for precise version information and upgrade paths.

The disclosure of these twelve vulnerabilities in a single batch underscores the importance of timely patching and diligent security practices for users of the Netty framework. Given the breadth of affected components and the potential for denial-of-service and resource exhaustion, organizations relying on Netty should prioritize updating to the patched versions to mitigate these risks. Continued vigilance and prompt application of security updates are crucial for maintaining the integrity and availability of applications built with Netty.

CVE-2026-100666, CVE-2026-100665, CVE-2026-100664, CVE-2026-100663, CVE-2026-100662, CVE-2026-100661, CVE-2026-100660, CVE-2026-100659, CVE-2026-100658, CVE-2026-100657, CVE-2026-100656, CVE-2026-100655

Synthesized by Vypr AI