Description

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge, a remote client can send a request such as "GET https://trusted.example/admin HTTP/1.1" with "Host: attacker.example", causing components that validate, authorize, or route on the RFC-defined request-target authority to reach a different decision than the upstream HTTP/3 peer, which receives :authority derived from the conflicting Host header. This authority confusion can affect virtual-host routing, allow-list checks, backend selection, cache keys, and URL generation. The advisory reports integrity impact only (no code execution, memory corruption, or availability impact). Fixed in 4.2.18.Final.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T14:16:49.540Z",
  "pubdate": "2026-09-26T14:16:49.540Z",
  "executiveSummary": "This vulnerability involves an authority header confusion flaw in io.netty:netty-codec-http3, affecting versions 4.2.2.Final through 4.2.17.Final. The issue arises during the conversion of HTTP/1.x requests to HTTP/3, where the implementation incorrectly prioritizes the HTTP/1 Host header over the authority specified in an absolute-form request-target.\nThis behavior violates RFC-defined requirements for handling absolute-form requests, which mandate that the Host header be ignored in favor of the request-target's authority. The primary impact is an integrity compromise within HTTP/1-to-HTTP/3 gateways, proxies, or protocol bridges. By crafting requests with conflicting authority definitions, a remote attacker can deceive downstream security controls, including virtual-host routing, allow-list enforcement, backend selection, and cache key generation. This vulnerability facilitates authority-based security bypasses, as the upstream peer receives a forged :authority pseudo-header. No memory corruption or code execution is associated with this vulnerability, but the potential for unauthorized access or misrouting in proxy environments is significant. Exploitation requires no specific authentication or privileges, as it targets the fundamental protocol translation layer.",
  "technicalDetails": "The vulnerability resides in the HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) method, which is utilized by the Http3FrameToHttpObjectCodec(false) class. The root cause is a logic error in the precedence implementation when mapping HTTP/1 request headers to HTTP/3 :authority pseudo-headers. Under standard HTTP/1.1 specifications, when an absolute-form request-target (e.g., 'GET https://trusted.example/admin HTTP/1.1') is provided, the authority within that URI must take precedence over the 'Host' header. However, the affected Netty components prioritize a non-empty 'Host' header, effectively overriding the intended destination authority.\nThe attack flow follows a 'Request Smuggling-style' logic where an attacker sends an HTTP/1 request containing both an absolute-form request-target and a conflicting Host header (e.g., 'Host: attacker.example'). When this request passes through a Netty-based proxy or bridge, the internal conversion logic generates an HTTP/3 :authority header based on the malicious Host header. The bridge then forwards this request to an upstream HTTP/3 peer. If the downstream environment relies on the :authority pseudo-header for security-critical decisions—such as virtual-host routing, authorization allow-lists, or backend selection—the attacker succeeds in forcing the peer to process the request as if it were directed to 'attacker.example' rather than 'trusted.example'.\nThis integrity impact allows for a variety of bypass scenarios. For instance, if an allow-list or firewall component validates the target based on the request-target, it might see the legitimate domain, while the eventual recipient uses the forged authority to determine the backend or the cache entry. This can lead to cache poisoning, bypass of domain-based access controls, or routing traffic to internal services that were intended to be unreachable via the public-facing domain. The vulnerability is present in versions 4.2.2.Final through 4.2.17.Final and does not require complex payloads or exploitation of memory management, as it is a logical failure in the implementation of the HTTP protocol mapping layer."
}