Netty: Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to… (CVE-2026-47244)

Netty, a network application framework, had a flaw in versions before 4.1.135.Final and 4.2.15.Final where DefaultHttp2Connection.DefaultEndpoint set maxActiveStreams and maxStreams to Integer.MAX_VALUE by default. Additionally, Http2Settings did not insert SETTINGS_MAX_CONCURRENT_STREAMS by default, meaning a Netty HTTP/2 server would advertise no limit on concurrent streams and enforce none locally unless explicitly configured. This allows a single TCP connection to create hundreds of thousands of long-lived stream objects, consuming significant server resources. This condition also sets the stage for amplification attacks similar to CVE-2023-44487. The vulnerability is addressed in versions 4.1.135.Final and 4.2.15.Final.

The vulnerability allows an attacker to open an unlimited number of concurrent HTTP/2 streams on a Netty server, leading to high resource consumption such as memory and processing overhead due to the allocation of stream-related objects. This can degrade server performance or cause denial of service conditions. There is no impact on confidentiality or integrity. The vulnerability is rated medium severity with a CVSS score of 5.3.

Upgrade Netty to version 4.1.135.Final or later, or 4.2.15.Final or later, where this issue is patched. Alternatively, explicitly configure the maxConcurrentStreams setting via initialSettings() to impose a limit on concurrent HTTP/2 streams. No other vendor advisories or cloud service mitigations are indicated.