Netty's SpdySessionHandler accepts an unlimited number of concurrent remote-initiated SPDY streams because the localConcurrentStreams parameter defaults to Integer.MAX_VALUE and cannot be changed via an API. A remote peer can exploit this by opening a SPDY connection and sending many SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation. This resource exhaustion can lead to JVM OutOfMemoryError and crash the service, resulting in denial of service. Red Hat's advisory confirms the issue and notes the lack of an effective mitigation or fix that meets their criteria. The CVSS v3.1 score is 7.5 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and high availability impact.

The vulnerability allows a remote attacker to exhaust system memory resources by opening many concurrent SPDY streams, leading to JVM OutOfMemoryError and service crash. This impacts availability but does not affect confidentiality or integrity. The flaw is due to unbounded resource allocation without limits or throttling.

According to the Red Hat advisory, no mitigation or fix currently meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor vendor advisories for future patches or mitigations. Upgrading to fixed versions when available is recommended. No temporary or official fix is currently provided by Red Hat.