AIKIDO-2026-110281

TL;DR

This row consolidates the HTTP/3 (netty-codec-http3) security fixes in this release. GHSA-495p-pchh-r4mc: the QPACK encoder keeps an unbounded per stream map of dynamic-table reference trackers that is never released when a peer withholds Section Acknowledgments, so heap grows across sequential requests on one QUIC connection until exhaustion. GHSA-f64r-x647-cg8w: the QPACK encoder-stream decoder lacks length and cumulation caps, so Insert-With-Literal-Name instructions with unbounded lengths force large allocations and an OutOfMemoryError. GHSA-v5p2-hmgx-3xrx: a non-terminating QPACK prefixed integer drives unbounded accumulation plus O(n^2) CPU consumption. GHSA-q9pg-8h3j-8hvm: the HTTP/3 codec does not require the :authority pseudo-header and any literal host header to match, allowing request routing and access-control bypass. GHSA-hfr2-x62w-v49h: HTTP/1-to-HTTP/3 conversion lets the Host header override an absolute-form request-target authority in :authority. GHSA-jgph-cgq3-c627: HTTP/1 authority-form CONNECT is mistranslated to a malformed HTTP/3 CONNECT with Host-controlled :authority. GHSA-w6j8-x45j-w75f: HTTP/3 Extended CONNECT requests are downgraded to plain CONNECT tunnels. The fixes add QPACK resource bounds and enforce correct HTTP/3 header and authority handling.