Read the docs
TI-2026-64820 Aliases CVE-2026-100664GHSA-gjrj-m8xc-f2cm

Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge, a remote client can send a request such as "GET https://trusted.example/admin HTTP/1.1" with "Host: attacker.example", causing components that validate, authorize, or route on the RFC-defined request-target authority to reach a different decision than the upstream HTTP/3 peer, which receives :authority derived from the conflicting Host header. This authority confusion can affect virtual-host routing, allow-list checks, backend selection, cache keys, and URL generation. The advisory reports integrity impact only (no code execution, memory corruption, or availability impact). Fixed in 4.2.18.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Partial netty (netty): 4.2.18.FinalRed Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty4.2.2.Final to before 4.2.18.Final4.2.18.FinalPatch availableCNA
  • netty Vendornetty Affected 4.2.2.Final to before 4.2.18.Final Fixed in 4.2.18.Final Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*——netty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions — — ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.2.18.Final

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    netty 4.2.18.Final

    7 records Highest priority Priority HIGH 4 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification BypassPriority HIGH 77
    • TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoSPriority HIGH 77
    • TI-2026-64816 Netty before 4.2.18.Final QpackEncoder Unbounded Memory RetentionPriority HIGH 77
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100664
  2. 2026-10-03 Alias added: GHSA-gjrj-m8xc-f2cm

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
  • TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences