Netty is a network application framework for development of protocol servers and clients.

SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. When a remote peer opens a SPDY connection and sends millions of SYN_STREAM frames with FLAG_FIN=0, the server allocates unbounded heap and direct memory, eventually triggering JVM OutOfMemoryError and crashing the service.

This issue is tracked by GitHub Security Advisory GHSA-rmcw-9fcq-wjq7. No CVE ID has been assigned yet.

Affected package: io.netty:netty-codec-http
- <= 4.1.137.Final, fixed in 4.1.138.Final
- >= 4.2.0.Final, <= 4.2.17.Final, fixed in 4.2.18.Final

Upstream advisory: https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7
Releases: https://github.com/netty/netty/releases/tag/netty-4.1.138.Final
          https://github.com/netty/netty/releases/tag/netty-4.2.18.Final