Loading vulnerability…
Netty HTTP/3 Unbounded Header Section Memory Exhaustion
CVE-2026-44892 is an uncontrolled resource-consumption vulnerability in Netty's HTTP/3 codec prior to 4.2.15.Final. The default configuration of Http3ConnectionHandler and Http3FrameCodec does not enforce a maximum HTTP/3 header field section size when the peer has not explicitly specified HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE. A malicious HTTP/3 peer can therefore submit an enormous number of headers, causing unbounded memory consumption during header processing and potentially triggering an OutOfMemoryError.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote HTTP/3 client or server acting as the connected peer can exhaust application memory and terminate or destabilize the JVM with an OutOfMemoryError. Successful exploitation results in denial of service for the affected Netty application and may affect other workloads sharing the same JVM or host resources.
If you can’t patch tonight, do this now.
Until patched, explicitly configure Netty HTTP/3 settings with a finite maximum header field section size rather than relying on the default behavior. Restrict HTTP/3 service exposure to trusted peers where feasible and apply connection, request, and infrastructure-level resource limits to reduce denial-of-service impact.
Patch, then assume compromise.
Upgrade the Netty HTTP/3 codec to version 4.2.15.Final or later, which enforces a safe maximum header-size limit in the affected HTTP/3 handling path. Update all deployed Netty HTTP/3 dependencies and rebuild or redeploy applications as appropriate.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.