CVE-2026-93488: Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM frames with FLAGFIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
Other sources
Netty is a network application framework for development of protocol servers and clients.
SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. When a remote peer opens a SPDY connection and sends millions of SYNSTREAM frames with FLAGFIN=0, the server allocates unbounded heap and direct memory, eventually triggering JVM OutOfMemoryError and crashing the service.
This issue is tracked by GitHub Security Advisory GHSA-rmcw-9fcq-wjq7. No CVE ID has been assigned yet.
Affected package: io.netty:netty-codec-http - <= 4.1.137.Final, fixed in 4.1.138.Final - >= 4.2.0.Final, <= 4.2.17.Final, fixed in 4.2.18.Final
Upstream advisory: https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7 Releases: https://github.com/netty/netty/releases/tag/netty-4.1.138.Final https://github.com/netty/netty/releases/tag/netty-4.2.18.Final
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.2.18.Final - Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.138.Final - Compensating control
Apply an external mitigation by restricting/untrusted-ingress limiting access to the service’s network endpoints so that remote peers cannot open SPDY connections and flood SYN_STREAM frames (e.g., rate-limit/limit concurrent connections at the network edge or load balancer) until the Netty fixed version (4.2.18.Final or 4.1.138.Final) is deployed.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using io.netty:netty-codec-http through version 4.1.137.Final or versions 4.2.0.Final through 4.2.17.Final are affected when they use SpdySessionHandler and accept remote SPDY connections.
What does an attacker need to do to trigger the denial of service?
An unauthenticated remote peer needs to establish a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0. This creates unlimited concurrent remote-initiated streams and can exhaust heap and direct memory until the JVM throws OutOfMemoryError.
Is the default concurrent-stream limit protective?
No. SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE, effectively permitting an unlimited number of remote-initiated streams, and the handler provides no API to change that limit.
What versions contain the fix?
The fix is available in 4.1.138.Final for the 4.1 release line and 4.2.18.Final for the 4.2 release line.