CVE-2026-44892: Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size

Synopsis

This is a denial-of-service vulnerability in Netty's HTTP/3 codec caused by a missing maximum header size limit in the default configuration of Http3ConnectionHandler. The flaw is reachable over the network with no authentication required, making it trivially exploitable by any client that can send HTTP/3 traffic to an affected service. A malicious peer sends an oversized or excessive number of HTTP/3 headers, exhausting JVM heap memory and crashing the service with an OutOfMemoryError. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network by sending HTTP/3 traffic; no local access or special network position is required.

• AuthenticationNot required

  No credentials or session token are needed; any unauthenticated peer that can open an HTTP/3 connection can trigger the vulnerability.

• Victim interactionNot required

  The attack is entirely server-side and requires no action from a legitimate user or operator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply sends oversized or excessive headers over a standard HTTP/3 connection without needing to satisfy any timing or environmental precondition.

Blast Radius

• The targeted JVM process exhausts heap memory and terminates with an OutOfMemoryError, taking down any service hosted by that Netty instance.
• All in-flight requests and active connections to the service are dropped at the moment of crash, interrupting service for legitimate clients.
• Depending on restart policy and infrastructure configuration, the crash may cascade into repeated OOM loops if the malicious client reconnects before the heap limit is enforced.