{"id":29744,"date":"2026-09-27T00:31:36","date_gmt":"2026-09-26T16:31:36","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100664"},"modified":"2026-09-27T00:31:36","modified_gmt":"2026-09-26T16:31:36","slug":"cve-2026-100664","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-100664","title":{"rendered":"CVE-2026-100664 [HIGH] &#8211; Netty&#8217;s HTTP\/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Fina"},"content":{"rendered":"<p>Netty&#8217;s HTTP\/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP\/3 :authority pseudo-header from the HTTP\/1 Host header before considering the authority of an absolute-form HTTP\/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) \u2014 reached via Http3FrameToHttpObjectCodec(false) \u2014 a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP\/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP\/1-to-HTTP\/3 gateway, proxy, or protocol bridge, a remote client can send a request such as &#8220;GET https:\/\/trusted.example\/admin HTTP\/1.1&#8221; with &#8220;Host: attacker.example&#8221;, causing components that validate, authorize, or route on the RFC-defined request-target authority to reach a different decision than the upstream HTTP\/3 peer, which receives :authority derived from the conflicting Host header. This authority confusion can affect virtual-host routing, allow-list checks, backend selection, cache keys, and URL generation. The advisory reports integrity impact only (no code execution, memory corruption, or availability impact). Fixed in 4.2.18.Final.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Netty&#8217;s HTTP\/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP\/3 :authority pseudo-header from the HTTP\/1 Host header before considering the authority of a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29744","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29744","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29744"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29744"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}