CVE-2026-100655: Netty before 4.1.138.Final Denial of Service via SpdySessionHandler
Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A remote peer that opens a SPDY connection and sends millions of SYNSTREAM frames with FLAGFIN=0 causes the server to allocate unbounded heap and direct memory, eventually triggering a JVM OutOfMemoryError and crashing the service. Fixed in 4.1.138.Final and 4.2.18.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.138.Final - Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.2.18.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using io.netty:netty-codec-http with an affected version and handling SPDY connections through SpdySessionHandler are exposed. The affected ranges are versions through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final.
What does an attacker need to do to trigger the issue?
An unauthenticated remote peer needs to open a SPDY connection and send millions of SYN_STREAM frames without FLAG_FIN set. This creates concurrent remote-initiated streams until heap and direct memory are exhausted, causing a JVM OutOfMemoryError and service crash.
Is the default configuration affected?
Yes. SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE, allowing an unlimited number of concurrent remote-initiated SPDY streams. The handler provides no API to reduce this limit.
What versions remediate the issue?
Upgrade to 4.1.138.Final or later on the 4.1 line, or to 4.2.18.Final or later on the 4.2 line.