CVE-2026-100655

Name of the Vulnerable Software and Affected Versions Netty (io.netty:netty-codec-http) versions prior to 4.1.138.Final Netty (io.netty:netty-codec-http) versions 4.2.0.Final through 4.2.17.Final

Description The software accepts an unlimited number of concurrent remote-initiated SPDY streams because the SpdySessionHandler defaults localConcurrentStreams to Integer.MAX VALUE and provides no API to modify this value. A remote peer can exploit this by opening a SPDY connection and sending a massive volume of SYN STREAM frames with FLAG FIN=0, forcing the server to allocate unbounded heap and direct memory. This leads to a JVM OutOfMemoryError, which crashes the service.

Recommendations Update to version 4.1.138.Final. Update to version 4.2.18.Final.