Netty before 4.1.138.Final Denial of Service via SpdySessionHandler
Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE and exposes no API to change it. A remote peer that opens a SPDY connection and sends millions of SYN_STREAM frames with FLAG_FIN=0 causes the server to allocate unbounded heap and direct memory, eventually triggering a JVM OutOfMemoryError and crashing the service. Fixed in 4.1.138.Final and 4.2.18.Final.
CVE-2026-100655
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2026-100655
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://github.com/netty/netty",
"type": "GIT",
"events": [
{
"introduced": "09e64d259c99be8b5b2a471a78f11e65eb82598a"
},
{
"fixed": "e0789d32c72f46fd2e7c99b6fdbbf7e2f4409e44"
}
],
"database_specific": {
"source": "DESCRIPTION",
"extracted_events": [
{
"introduced": "4.2.0.Final"
},
{
"fixed": "4.2.17.Final"
}
]
}
}
],
"versions": [
"netty-4.2.16.Final",
"netty-4.2.15.Final",
"netty-4.2.14.Final",
"netty-4.2.13.Final",
"netty-4.2.12.Final",
"netty-4.2.11.Final",
"netty-4.2.10.Final",
"netty-4.2.9.Final",
"netty-4.2.8.Final",
"netty-4.2.7.Final",
"netty-4.2.6.Final",
"netty-4.2.5.Final",
"netty-4.2.4.Final",
"netty-4.2.3.Final",
"netty-4.2.2.Final",
"netty-4.2.1.Final",
"netty-4.2.0.Final"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100655.json"
}
}
]- Related CVEs
- CVE-2026-100655
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #23957 · Revision 1
- Added to Heist Feed
- Publisher date