Loading vulnerability…
Denial of Service via Uncontrolled HTTP/2 Concurrent Streams in Netty
CVE-2026-47244 is a resource-exhaustion vulnerability in Netty's netty-codec-http2 component affecting the 4.1.x and 4.2.x branches before 4.1.135.Final and 4.2.15.Final, respectively. DefaultHttp2Connection.DefaultEndpoint initializes maxActiveStreams and maxStreams to Integer.MAX_VALUE, while Http2Settings does not supply SETTINGS_MAX_CONCURRENT_STREAMS by default. Unless an application explicitly configures a concurrent-stream limit, an HTTP/2 server neither advertises nor locally enforces a practical limit. A remote client can consequently create large numbers of concurrent streams over one TCP connection, each allocating stream objects, property storage, flow-control state, and map entries. This can exhaust server resources and cause denial of service. The absence of a low concurrent-stream cap can also amplify backend work during CVE-2023-44487-style Rapid Reset abuse.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Excessive concurrent HTTP/2 streams can consume server memory and stream-management resources, degrading service or causing denial of service. A single TCP connection can retain hundreds of thousands of long-lived stream objects, reducing the connection overhead needed to exhaust resources. The missing limit can additionally increase backend work during Rapid Reset-style attacks. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
Explicitly configure a conservative HTTP/2 concurrent-stream limit by calling initialSettings().maxConcurrentStreams(n). Choose a finite value appropriate to the application's capacity and workload so the server advertises and enforces the limit until a fixed version is deployed.
Patch, then assume compromise.
Upgrade io.netty:netty-codec-http2 to 4.1.135.Final or later in the 4.1.x branch, or 4.2.15.Final or later in the 4.2.x branch. For applications bundling Netty through another product or framework, deploy a vendor-supported release incorporating the corrected component.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.