# CVE-2026-100655: Netty netty-codec-http denial of service in SpdySessionHandler

Source: https://junglewise.ai/threats/cve-2026-100655-netty-io-netty-netty-codec-http-versions-up-to-and-including-4-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100655 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty is a Java networking library used to build high-performance servers and network applications. The SPDY protocol handler fails to limit the number of concurrent streams a remote peer can initiate, allowing an attacker to exhaust server memory by opening millions of streams, which crashes the service.

Technologies: [Netty-Codec-Http](https://junglewise.ai/threats/technologies/netty-netty-codec-http). Vendors: [Netty](https://junglewise.ai/threats/vendors/netty).

## Quick answers

**Is CVE-2026-100655 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100655 being exploited in the wild.

**How severe is CVE-2026-100655?** High severity, with a CVSS score of 7.5, published 26 September 2026.

**Which products and versions are affected?** Netty-Codec-Http up to 4.1.137.Final and 4.2.0.Final through 4.2.17.Final.

**Is there a fix for CVE-2026-100655?** A patch was published on 2026-09-26: Patched in 4.1.138.Final and 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100655 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100655?** Check whether you run Netty-Codec-Http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE with no API to configure it. A remote attacker can send numerous SYN_STREAM frames with FLAG_FIN=0 over a SPDY connection, causing unbounded allocation of heap and direct memory until JVM OutOfMemoryError occurs. The vulnerability requires network access and affects versions 4.1.137.Final and earlier, and 4.2.0.Final through 4.2.17.Final; patches are available in 4.1.138.Final and 4.2.18.Final.

## Affected products

- Netty netty-codec-http up to 4.1.137.Final and 4.2.0.Final through 4.2.17.Final

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: Patched in 4.1.138.Final and 4.2.18.Final

## References

- [https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7](https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7)
- [https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-spdysessionhandler](https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-spdysessionhandler)

## Related threats

- [Netty unbounded queue denial of service in WebSocketServerExtensionHandler](https://junglewise.ai/threats/cve-2026-100658-netty-io-netty-netty-codec-http-contains-an-unbounded-per)
- [Netty HttpServerCodec unbounded queue growth via HTTP/1.1 pipelining](https://junglewise.ai/threats/cve-2026-100656-netty-io-netty-netty-codec-http-contains-an-unbounded-per)