Bug 2536887 (CVE-2026-93488)

Summary:	CVE-2026-93488 io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ant, anujha, aschwart, asoldano, aszczucz, ataylor, bbaranow, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, csuconic, dbruscin, dlofthou, drichtar, ehugonne, ewittman, fmariani, fmongiar, gmalinko, gsmet, gtully, istudens, ivassile, iweiss, janstey, jmartisk, jnethert, jpechane, jsherman, jwon, kvanderr, manderse, mcarlett, mosmerov, mposolda, msvehla, nipatil, nwallace, olubyans, ozzy, pantinor, pberan, pdelbell, pesilva, pjindal, pmackay, rgemmell, rgodfrey, rguimara, rkubis, rmartinc, rstancel, rstepani, sbiarozk, ssilvert, sthorger, tbish, tcunning, thjenkin, tlavocat, varjain, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-18 05:43:29 UTC

Netty is a network application framework for development of protocol servers and clients.

SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. When a remote peer opens a SPDY connection and sends millions of SYN_STREAM frames with FLAG_FIN=0, the server allocates unbounded heap and direct memory, eventually triggering JVM OutOfMemoryError and crashing the service.

This issue is tracked by GitHub Security Advisory GHSA-rmcw-9fcq-wjq7. No CVE ID has been assigned yet.

Affected package: io.netty:netty-codec-http
- <= 4.1.137.Final, fixed in 4.1.138.Final
- >= 4.2.0.Final, <= 4.2.17.Final, fixed in 4.2.18.Final

Upstream advisory: https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7
Releases: https://github.com/netty/netty/releases/tag/netty-4.1.138.Final
          https://github.com/netty/netty/releases/tag/netty-4.2.18.Final