Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-10T00:39:48 io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

This is an Important denial of service flaw in Netty's SpdySessionHandler that could allow a remote attacker to exhaust system resources by sending a large number of SPDY SYN_STREAM frames. This can lead to an OutOfMemoryError and crash the affected service, impacting availability. The default configuration allows for an unlimited number of concurrent streams, making services using Netty with SPDY vulnerable to this resource exhaustion attack. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat AMQ Broker 7 Affected netty-codec-http Red Hat AMQ Clients Affected netty-codec-http Red Hat build of Apache Camel 4 for Quarkus 3 Affected netty-codec-http Red Hat build of Apache Camel for Spring Boot 4 Affected netty-codec-http Red Hat build of Apicurio Registry 3 Affected netty-codec-http Red Hat build of Debezium 3 Affected netty-codec-http Red Hat Build of Keycloak Affected netty-codec-http Red Hat Data Grid 8 Affected netty-codec-http Red Hat Fuse 7 Out of support scope netty-codec-http Red Hat JBoss Enterprise Application Platform 7 Out of support scope netty-codec-http Red Hat JBoss Enterprise Application Platform 8 Affected netty-codec-http Red Hat Single Sign-On 7 Fix deferred netty-codec-http https://www.cve.org/CVERecord?id=CVE-2026-93488 https://nvd.nist.gov/vuln/detail/CVE-2026-93488 https://github.com/netty/netty/releases/tag/netty-4.1.138.Final https://github.com/netty/netty/releases/tag/netty-4.2.18.Final