CVE-2026-100661

A flaw was found in Netty's HTTP/3 codec. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a specially crafted stream of data to the QPACK integer decoder. Because the decoder fails to limit incoming continuation bytes, data accumulates indefinitely in memory while repeatedly rescanning the buffer. This unbounded accumulation can exhaust system memory and consume excessive CPU resources, rendering the service unresponsive.

Last checked: 2026-10-02 22:03 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-10-02 20:46 UTC)

References

• NVD: CVE-2026-100661
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-09-26 22:17 UTC