Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100659Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Medium 6.5

In plain English

A medium-severity security flaw in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single HEADERS frame containing both fields with differing, attacker-controlled values; the request is accepted and delivered to the application with two conflicting authorities, allowing routing, virtual-host, and access-control decisions to be bypassed when different components in the request path consult different fields. This issue is fixed in 4.2.18.Final.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:26.10	netty	no fix listed	UBUNTU-CVE-2026-100659

Affected products (as reported)

Vendor	Product	Versions
netty	netty	4.2.0.Final – before 4.2.18.Final

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-q9pg-8h3j-8hvm) vendor-advisory
VulnCheck Advisory: Netty 4.2.0 through 4.2.18 HTTP/3 Request Routing Bypass third-party-advisory