CVE-2026-93488 — Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and…
Published: 2026-09-18 · CVSS: 7.5 · CVSS 3.1
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7