Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw Exploit, Vendor Advisory
- https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · nettyNVD modified 2026-10-26 00:10
Affected (CPE criteria) 1
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
References 2
- https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw Exploit, Vendor Advisory
- https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw Exploit, Vendor Advisory