Applications
CVE-2026-100662
HTTP/3 QPACK encoder allows remote OOM leading to DoS (Netty 4.2.0–4.2.17).
Major vulnerability. Netty is a widely used Java networking library; an HTTP/3 QPACK DoS can disrupt many server applications and services across organizations.
- CVSS
- 8.7Highscored by the publisher (CNA)
- Exploited in the wild
- Not knownpublic proof of concept per CISA SSVC; not in CISA KEV
- EPSS
- 0.42%chance of exploitation in the next 30 daystop 64% of scored CVEsFIRST score of 12 Nov 2026
- Fix
- Fixed in 4.2.18.Finalper the vendor
- Published
- 26 Sept 2026analysed here 28 Sept 2026
Do first. Upgrade to a fixed release: 4.2.18.Final.
Summary
Impact
Remote unauthenticated attacker can force unbounded per-connection heap growth and trigger OutOfMemoryError, causing denial of service via crafted QPACK encoder-stream.
Triage
The summary, impact and action text on this page are written by our AI analysis pipeline, or taken from the NVD description when a CVE was imported from NVD. They are not the vendor's wording: check them against the sources. A longer AI executive summary and technical analysis are generated for signed-in accounts on the Max plan.
Affected products
| Product | Affected versions | Vendor says fixed in |
|---|---|---|
| netty | >= 4.2.0.Final and < 4.2.18.FinalVendor says fixed in: 4.2.18.Final |
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.
Products named in our analysis
- io.netty:netty-codec-http3 4.2.0.Final - 4.2.17.Final
- Netty-based HTTP/3 servers and services
Fix and mitigation
Action required
Patch when possible
WAF and other mitigations
Can a WAF block it? No. The vulnerability is triggered by HTTP/3 QPACK encoding, which is part of normal HTTP/3 traffic, so malicious requests look like normal HTTP/3 requests and cannot be reliably distinguished by a WAF.
Also consider: rate limit · CDN
Based on an AI reading of the CVE description, and no vendor rule found yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.
Remediation steps (AI-written)
Step-by-step remediation is generated for accounts on the Max plan, for CVEs that match a technology in their stack. Add this technology to your stack to see the fix checklist.
Exploitation evidence
- CISA KEV catalog
- Not listed as of our last sync.
- Public exploit code
- None on record in Exploit-DB, Metasploit, Nuclei templates or PoC-in-GitHub.
- CISA SSVC
- exploitation poc, automatable yes, technical impact partialAssessed by CISA 30 Sept 2026 (SSVC 2.0.3). Exploitation is none, poc (public proof of concept) or active.
Timeline
- 26 Sept 2026Published
- 28 Sept 2026Analysed by vulneraibility.com2 days later
- 30 Sept 2026CISA SSVC assessment: exploitation poc2 days later
- 30 Sept 2026CVE record last updatedsame day later
Common questions
Is CVE-2026-100662 being exploited?
Not confirmed. CVE-2026-100662 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.42% probability of exploitation in the next 30 days.
How severe is CVE-2026-100662?
CVE-2026-100662 is rated High with a CVSS score of 8.7. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-100662?
Yes. A fix has been recorded for CVE-2026-100662. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-100662 affect?
CVE-2026-100662 affects io.netty:netty-codec-http3 4.2.0.Final - 4.2.17.Final, Netty-based HTTP/3 servers and services. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-100662?
Upgrade to netty-codec-http3 4.2.18.Final; limit QPACK/HTTP/3 stream sizes and monitor for OOMs.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
References
2 references in the CVE record, grouped by the tags the record gives them.
Advisories (2)
- github.com /netty/netty/security/advisories/GHSA-f64r-x647-cg8w
- vulncheck.com /advisories/netty-http-3-qpack-encoder-stream-unbounded-memory-exhaustion-dos
Also tracked as GHSA-f64r-x647-cg8w (OSV).
Where the data on this page comes from
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- CISA Vulnrichment (ADP): SSVC decision points
- FIRST EPSS: exploit probability and percentile
- OSV: advisory aliases and downstream package versions
Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.
Similar CVEs
Get CVEs like this by email. Join the free digest: the CVEs we flag as major, all CVSS 8.0 or higher, in up to three emails a day (sent at 05:00, 11:00 and 15:00 UTC). Matching alerts to the products you run needs an account, and accounts are invite-only during the beta.