{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/netty-all-versions/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-93488"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Netty (all versions)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","java","networking"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eCVE-2026-93488 is a high-severity vulnerability discovered in the Netty framework's SPDY implementation. The \u003ccode\u003eSpdySessionHandler\u003c/code\u003e fails to restrict the number of concurrent remote-initiated streams because the \u003ccode\u003elocalConcurrentStreams\u003c/code\u003e setting defaults to \u003ccode\u003eInteger.MAX_VALUE\u003c/code\u003e, and the library provides no API to modify this threshold.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated remote attacker can exploit this by establishing a SPDY connection and initiating a flood of \u003ccode\u003eSYN_STREAM\u003c/code\u003e frames with the \u003ccode\u003eFLAG_FIN\u003c/code\u003e flag set to 0. Because the handler does not bound these streams, each request forces the application to allocate memory on the JVM heap and in direct memory buffers. Sustained exploitation leads to memory exhaustion, triggering a \u003ccode\u003ejava.lang.OutOfMemoryError\u003c/code\u003e and resulting in a denial of service (DoS) for the affected service. Given Netty's widespread use in high-performance networking applications, this vulnerability poses a significant risk to the availability of systems relying on the SPDY protocol.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete denial of service for the targeted Netty-based application. Since the vulnerability resides within the low-level transport handler, an attacker can crash the JVM by sending specially crafted, resource-intensive SPDY control frames, potentially leading to widespread downtime for critical infrastructure components.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDetection and mitigation teams should prioritize identifying applications utilizing the SPDY protocol with vulnerable versions of the Netty framework.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eInventory all Java applications utilizing the \u003ccode\u003eio.netty:netty-codec-http2\u003c/code\u003e or \u003ccode\u003enetty-all\u003c/code\u003e libraries to identify instances where the \u003ccode\u003eSpdySessionHandler\u003c/code\u003e is enabled.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for JVM memory usage, specifically tracking \u003ccode\u003ejava.lang.OutOfMemoryError\u003c/code\u003e exceptions that correlate with increased network traffic from external SPDY peers.\u003c/li\u003e\n\u003cli\u003ePatch applications to the version of Netty that introduces a configuration API or restrictive default for \u003ccode\u003elocalConcurrentStreams\u003c/code\u003e as identified in official Netty security bulletins.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, consider disabling SPDY support at the load balancer or reverse proxy level if the protocol is not strictly required for business operations.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-18T14:05:58Z","date_published":"2026-09-18T14:05:58Z","id":"https://feed.craftedsignal.io/briefs/2026-09-netty-dos/","summary":"The Netty SpdySessionHandler component is vulnerable to a denial of service attack via uncontrolled concurrent stream allocation, potentially exhausting JVM heap and direct memory.","title":"CVE-2026-93488 Denial of Service in Netty SpdySessionHandler","url":"https://feed.craftedsignal.io/briefs/2026-09-netty-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty (All Versions)","version":"https://jsonfeed.org/version/1.1"}