CVE-2026-100655 PUBLISHED

Netty before 4.1.138.Final Denial of Service via SpdySessionHandler

Assigner: VulnCheck
Reserved: 26.09.2026 Published: 26.09.2026 Updated: 26.09.2026

Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE and exposes no API to change it. A remote peer that opens a SPDY connection and sends millions of SYN_STREAM frames with FLAG_FIN=0 causes the server to allocate unbounded heap and direct memory, eventually triggering a JVM OutOfMemoryError and crashing the service. Fixed in 4.1.138.Final and 4.2.18.Final.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor netty
Product netty
Versions Default: unaffected
  • affected from 0 to 4.1.138.Final (excl.)
  • Version 4.1.138.Final is unaffected
Vendor netty
Product netty
Versions Default: unaffected
  • affected from 4.2.0.Final to 4.2.18.Final (excl.)
  • Version 4.2.18.Final is unaffected

References

Problem Types

  • Allocation of Resources Without Limits or Throttling CWE