Executive brief
Netty is a popular Java network application framework used to build high-performance servers and clients. A flaw in its SPDY protocol handler allows a remote attacker to open a connection and send unlimited concurrent stream initiation frames, causing uncontrolled memory consumption that crashes the JVM. This results in service unavailability for any application using Netty's SPDY support.
Technical details
The vulnerability exists in SpdySessionHandler, where the localConcurrentStreams parameter defaults to Integer.MAX_VALUE with no API to configure it. An attacker can send repeated SYN_STREAM frames (with FLAG_FIN=0) over a SPDY connection without authentication or user interaction required. Each frame causes unbounded heap and direct memory allocation, triggering JVM OutOfMemoryError and denial of service. The root cause is inadequate stream limit validation in the SPDY protocol handler. A patch is available to enforce reasonable stream concurrency limits and proper cleanup.
Affected products
- Netty Netty <UNKNOWN>
Timeline
- 2026-09-18: disclosed