The vulnerability (CVE-2026-55831) exists in Netty's SPDY SETTINGS decoder within the io.netty:netty-codec-http component. The decoder accepts SETTINGS frames with a peer-controlled count of entries up to the 24-bit frame-length limit and materializes each unique setting ID in a TreeMap without limiting the total number of entries. An attacker can send a syntactically valid SETTINGS frame with 262,144 entries, causing the DefaultSpdySettingsFrame to create a large map with 262,144 attacker-controlled entries. This results in approximately 17-18 MiB of heap growth and CPU overhead per frame processed, enabling a remote unauthenticated denial of service via resource exhaustion. The vulnerability requires a valid SPDY/3.1 SETTINGS frame with IDs within the accepted 24-bit range. No official patch or remediation is currently documented.

A remote unauthenticated attacker capable of sending SPDY/3.1 frames to a vulnerable Netty pipeline can cause resource exhaustion by triggering excessive heap memory allocation and CPU usage. This leads to a denial of service condition due to unbounded growth of the settings map in memory. Confidentiality and integrity are not impacted, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling SPDY/3.1 support or filtering large SETTINGS frames at network boundaries to prevent exploitation. No official fix or temporary workaround is documented at this time.