Netty versions prior to 4.1.135.Final and 4.2.15.Final have a vulnerability in HTTP/2 max header size handling that can cause an attack similar to HTTP/2 Rapid Reset. When a client sends the SETTINGS_MAX_HEADER_LIST_SIZE setting, Netty processes the request but throws an exception while writing response headers. This behavior can disrupt service availability. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.