Denial-of-Service Vulnerability in Netty io.netty:netty-codec-http

Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final contain a vulnerability in the SpdySessionHandler component. The handler defaults the maximum number of local concurrent streams to Integer.MAX_VALUE and lacks an API to override this limit. An attacker can initiate a SPDY connection and flood the target server with a high volume of SYN_STREAM frames where the FLAG_FIN bit is set to zero. This forces the server to allocate unbounded heap and direct memory to maintain the session state, eventually exhausting available system memory and triggering a JVM OutOfMemoryError. This leads to a complete service disruption for any application utilizing the affected Netty codec. The vulnerability is addressed in versions 4.1.138.Final and 4.2.18.Final.

Impact

Successful exploitation results in a persistent denial-of-service condition affecting any Java application relying on the affected Netty codec for SPDY protocol support. This can lead to service downtime for critical infrastructure, APIs, and microservices. The impact is significant for organizations providing high-availability services where memory exhaustion leads to application crashes or service instability.

Recommendation

• Upgrade the Netty (io.netty:netty-codec-http) library to version 4.1.138.Final or 4.2.18.Final immediately to resolve CVE-2026-100655.
• Review network infrastructure logs to identify anomalous spikes in SPDY traffic or sustained connections from single remote peers that do not terminate streams.
• If immediate patching is not possible, implement network-level rate limiting or SPDY protocol inspection to block traffic from unverified sources attempting to establish an excessive number of concurrent streams.