CVE-2026-93488

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw in the SpdySessionHandler allows an unlimited number of concurrent remote-initiated streams because the localConcurrentStreams variable defaults to Integer.MAX VALUE and the handler lacks an API to modify this value. A remote peer can exploit this by opening a SPDY connection and sending numerous SYN STREAM frames with FLAG FIN=0, resulting in unbounded heap and direct memory allocation. This can lead to a JVM OutOfMemoryError, causing a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.