Executive brief
Netty is a widely used networking framework for building Java applications. A vulnerability in its HTTP/2 implementation allows a remote attacker to open an unlimited number of streams on a single connection, consuming excessive server memory and processing power. This can lead to a denial-of-service (DoS) condition, making the application unavailable to legitimate users.
Technical details
The vulnerability exists in the DefaultHttp2Connection component where maxActiveStreams is initialized to Integer.MAX_VALUE by default. Because Http2Settings does not automatically insert a SETTINGS_MAX_CONCURRENT_STREAMS value, a Netty server may advertise and enforce no limit on concurrent streams unless explicitly configured by the developer. An attacker can exploit this by opening hundreds of thousands of long-lived stream objects (DefaultStream, PropertyMap, etc.) over a single TCP connection, leading to uncontrolled memory consumption (CWE-400). This lack of a concurrent cap also facilitates Rapid-Reset style amplification attacks. The issue is resolved in versions 4.1.135.Final and 4.2.15.Final.
Affected products
- Netty netty-codec-http2 < 4.1.135.Final, 4.2.0.Final - 4.2.14.Final
Timeline
- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE-2026-47244 published to NVD