# CVE-2026-100663

Netty HTTP/3 codec mistranslates HTTP/1 CONNECT authority, allowing tunnel authority tampering.

- Page: https://www.vulneraibility.com/cve/CVE-2026-100663
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.30% (percentile 23.2)
- CISA SSVC: exploitation poc, automatable no, technical impact partial (assessed 2026-09-28)
- Weakness: CWE-20
- Also known as: GHSA-jgph-cgq3-c627
- Published: 2026-09-26

## Affected versions

- netty: affected >= 4.2.2.Final and < 4.2.18.Final; fixed in 4.2.18.Final

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote attacker can control HTTP/3 CONNECT :authority via mismatched Host, bypassing tunnel allow-lists, egress policy, backend selection, and audit controls.

## Action

Patch when possible

## Recommendation

Upgrade to io.netty:netty-codec-http3 4.2.18.Final; audit proxy CONNECT handling and allow-lists.

## References

- [advisory] https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627
- [advisory] https://www.vulncheck.com/advisories/netty-http-1-connect-authority-form-mistranslated-to-malformed-http-3

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.