# CVE-2026-100662

HTTP/3 QPACK encoder allows remote OOM leading to DoS (Netty 4.2.0–4.2.17).

- Page: https://www.vulneraibility.com/cve/CVE-2026-100662
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.42% (percentile 36.4)
- CISA SSVC: exploitation poc, automatable yes, technical impact partial (assessed 2026-09-30)
- Weakness: CWE-400
- Also known as: GHSA-f64r-x647-cg8w
- Published: 2026-09-26

## Affected versions

- netty: affected >= 4.2.0.Final and < 4.2.18.Final; fixed in 4.2.18.Final

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote unauthenticated attacker can force unbounded per-connection heap growth and trigger OutOfMemoryError, causing denial of service via crafted QPACK encoder-stream.

## Action

Patch when possible

## Recommendation

Upgrade to netty-codec-http3 4.2.18.Final; limit QPACK/HTTP/3 stream sizes and monitor for OOMs.

## References

- [advisory] https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w
- [advisory] https://www.vulncheck.com/advisories/netty-http-3-qpack-encoder-stream-unbounded-memory-exhaustion-dos

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.