# CVE-2026-100660

Netty HTTP/3 QPACK retains unbounded state, enabling remote OOM DoS.

- Page: https://www.vulneraibility.com/cve/CVE-2026-100660
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.45% (percentile 39.9)
- CISA SSVC: exploitation poc, automatable yes, technical impact partial (assessed 2026-09-28)
- Weakness: CWE-770
- Also known as: GHSA-495p-pchh-r4mc
- Published: 2026-09-26

## Affected versions

- netty: affected < 4.2.18.Final; fixed in 4.2.18.Final

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote unauthenticated HTTP/3 client can cause unbounded heap growth by omitting QPACK Section Acknowledgments, leading to server OOM/denial of service.

## Action

Patch when possible

## Recommendation

Upgrade to io.netty:netty-codec-http3 4.2.18.Final; throttle/monitor HTTP/3 connections.

## References

- [advisory] https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc
- [advisory] https://www.vulncheck.com/advisories/netty-before-4.2.18-final-qpackencoder-unbounded-memory-retention

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.