UBUNTU-CVE-2026-100664

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-100664
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100664.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-100664
Upstream
Published
2026-09-29T00:00:00Z
Modified
2026-09-29T23:41:44Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge, a remote client can send a request such as "GET https://trusted.example/admin HTTP/1.1" with "Host: attacker.example", causing components that validate, authorize, or route on the RFC-defined request-target authority to reach a different decision than the upstream HTTP/3 peer, which receives :authority derived from the conflicting Host header. This authority confusion can affect virtual-host routing, allow-list checks, backend selection, cache keys, and URL generation. The advisory reports integrity impact only (no code execution, memory corruption, or availability impact). Fixed in 4.2.18.Final.

References

Affected packages

Ubuntu:Pro:14.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:3.*
1:3.2.6.Final-2
1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libnetty-java",
            "binary_version":  "1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100664.json"
Ubuntu:Pro:16.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:3.*
1:3.2.6.Final-2
1:4.*
1:4.0.32-1
1:4.0.33-1
1:4.0.34-1
1:4.0.34-1ubuntu0.1~esm1
1:4.0.34-1ubuntu0.1~esm2
1:4.0.34-1ubuntu0.1~esm3
1:4.0.34-1ubuntu0.1~esm4
1:4.0.34-1ubuntu0.1~esm5

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libnetty-java",
            "binary_version":  "1:4.0.34-1ubuntu0.1~esm5"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100664.json"
Ubuntu:Pro:18.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:4.*
1:4.1.7-4
1:4.1.7-4ubuntu0.1~esm1
1:4.1.7-4ubuntu0.1
1:4.1.7-4ubuntu0.1+esm1
1:4.1.7-4ubuntu0.1+esm2
1:4.1.7-4ubuntu0.1+esm3
1:4.1.7-4ubuntu0.1+esm4
1:4.1.7-4ubuntu0.1+esm5
1:4.1.7-4ubuntu0.1+esm6
1:4.1.7-4ubuntu0.1+esm7

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libnetty-java",
            "binary_version":  "1:4.1.7-4ubuntu0.1+esm7"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100664.json"
Ubuntu:Pro:20.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:4.*
1:4.1.33-1
1:4.1.33-2
1:4.1.33-3
1:4.1.45-1
1:4.1.45-1ubuntu0.1~esm1
1:4.1.45-1ubuntu0.1~esm2
1:4.1.45-1ubuntu0.1~esm3
1:4.1.45-1ubuntu0.1~esm4
1:4.1.45-1ubuntu0.1~esm6
1:4.1.45-1ubuntu0.1~esm7

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libnetty-java",
            "binary_version":  "1:4.1.45-1ubuntu0.1~esm7"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100664.json"
Ubuntu:Pro:22.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:4.*
1:4.1.48-4
1:4.1.48-4+deb11u1build0.22.04.1
1:4.1.48-4+deb11u2build0.22.04.1
1:4.1.48-4+deb11u2ubuntu0.1~esm1
1:4.1.48-4+deb11u2ubuntu0.1~esm2
1:4.1.48-4+deb11u2ubuntu0.1
1:4.1.48-4+deb11u2ubuntu0.1+esm1
1:4.1.48-4+deb11u2ubuntu0.1+esm3
1:4.1.48-4+deb11u2ubuntu0.2
1:4.1.48-4+deb11u2ubuntu0.2+esm1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libnetty-java",
            "binary_version":  "1:4.1.48-4+deb11u2ubuntu0.2+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100664.json"
Ubuntu:Pro:24.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:4.*
1:4.1.48-7
1:4.1.48-8
1:4.1.48-9
1:4.1.48-9ubuntu0.1~esm1
1:4.1.48-9ubuntu0.1~esm2
1:4.1.48-9ubuntu0.1
1:4.1.48-9ubuntu0.1+esm1
1:4.1.48-9ubuntu0.1+esm3
1:4.1.48-9ubuntu0.2
1:4.1.48-9ubuntu0.2+esm1
1:4.1.48-9ubuntu0.2+esm2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libnetty-java",
            "binary_version":  "1:4.1.48-9ubuntu0.2+esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100664.json"
Ubuntu:Pro:26.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1:4.*
1:4.1.48-10
1:4.1.48-11
1:4.1.48-12
1:4.1.48-13
1:4.1.48-14
1:4.1.48-16
1:4.1.48-16ubuntu0.1~esm2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "libnetty-buffer-java",
            "binary_version":  "1:4.1.48-16ubuntu0.1~esm2"
        },
        {
            "binary_name":  "libnetty-common-java",
            "binary_version":  "1:4.1.48-16ubuntu0.1~esm2"
        },
        {
            "binary_name":  "libnetty-java",
            "binary_version":  "1:4.1.48-16ubuntu0.1~esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-100664.json"