AIKIDO-2026-110281
netty-codec-http3 is vulnerable to Denial of Service (DoS)
75
CVE Score
High
Denial of Service (DoS)
TL;DR
Netty's HTTP/3 QpackEncoder keeps a queue of dynamic table index trackers for every encoded field section that references the dynamic table. Those trackers are removed only when the peer sends a Section Acknowledgment or Stream Cancellation, and nothing limits how many one connection can hold. A peer that withholds those acknowledgments grows the tracker map across sequential requests on one QUIC connection until the process runs out of memory. The fix stops using the dynamic table once too many sections are still unacknowledged.
How do I fix this?
Upgrade the netty-codec-http3 and/or the io.netty:netty-codec-http3 library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your HTTP/3 server encodes response headers that can be indexed in the QPACK dynamic table.
Package
Versions
4.2.0.Final - 4.2.17.Final
Fixed in 4.2.18.FinalBackground info
netty-codec-http3 is vulnerable to Denial of Service (DoS) in versions 4.2.0.Final - 4.2.17.Final.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.