{"id":29741,"date":"2026-09-27T00:31:35","date_gmt":"2026-09-26T16:31:35","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100661"},"modified":"2026-09-27T00:31:35","modified_gmt":"2026-09-26T16:31:35","slug":"cve-2026-100661","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100661","title":{"rendered":"CVE-2026-100661 [HIGH] &#8211; Netty&#8217;s HTTP\/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Fina"},"content":{"rendered":"<p>Netty&#8217;s HTTP\/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 (&#8216;need more bytes&#8217;), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Netty&#8217;s HTTP\/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInt<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29741","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}