CVE-2026-100655
Received Received - Intake

Netty SPDY Stream Flooding Memory Exhaustion

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE and exposes no API to change it. A remote peer that opens a SPDY connection and sends millions of SYN_STREAM frames with FLAG_FIN=0 causes the server to allocate unbounded heap and direct memory, eventually triggering a JVM OutOfMemoryError and crashing the service. Fixed in 4.1.138.Final and 4.2.18.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100655
EUVD
EUVD-2026-87749

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
io.netty netty-codec-http From 4.2.0.Final (inc) to 4.2.17.Final (inc)
io.netty netty-codec-http 4.1.138.Final
io.netty netty-codec-http 4.2.18.Final
netty netty to 4.1.137_final (inc)
netty netty From 4.2.0_final (inc) to 4.2.17_final (inc)
netty netty 4.1.138_final
netty netty 4.2.18_final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Netty's SPDY protocol handler (SpdySessionHandler) in versions up to 4.1.137.Final and 4.2.0.Final through 4.2.17.Final. The default setting allows unlimited concurrent remote-initiated streams by setting localConcurrentStreams to Integer.MAX_VALUE. A remote attacker can exploit this by sending millions of SYN_STREAM frames with FLAG_FIN=0, causing the server to allocate excessive memory and crash due to OutOfMemoryError.

Detection Guidance

Monitor for excessive memory usage or JVM crashes in Netty-based applications handling SPDY connections. Check Netty version against 4.1.138.Final or 4.2.18.Final. Use network traffic analysis tools to detect high volumes of SYN_STREAM frames with FLAG_FIN=0.

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the service due to excessive memory allocation. It may lead to service unavailability, downtime, and potential data loss if the crash occurs during critical operations. Systems using vulnerable Netty versions are at risk if exposed to malicious SPDY connections.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or data unavailability, which may violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Downtime due to crashes could lead to unauthorized access or data breaches if systems fail to log or process requests properly during the outage.

Mitigation Strategies

Upgrade Netty to version 4.1.138.Final or 4.2.18.Final or later. If immediate upgrade is not possible, restrict SPDY connections via firewall rules or disable SPDY protocol in Netty configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100655. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart