Bug 2541863 (CVE-2026-100655) - CVE-2026-100655 io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams
Summary: CVE-2026-100655 io.netty/netty-codec-http: Netty: Denial of Service via unbou...
Keywords:
Status: NEW
Alias: CVE-2026-100655
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2542337
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-26 13:37 UTC by OSIDB Bzimport
Modified: 2026-09-28 07:31 UTC (History)
95 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-26 13:37:23 UTC 
Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE and exposes no API to change it. A remote peer that opens a SPDY connection and sends millions of SYN_STREAM frames with FLAG_FIN=0 causes the server to allocate unbounded heap and direct memory, eventually triggering a JVM OutOfMemoryError and crashing the service. Fixed in 4.1.138.Final and 4.2.18.Final.
Note You need to log in before you can comment on or make changes to this bug.