CVE-2026-47244 Details
Description
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
A denial-of-service vulnerability exists in Netty's HTTP/2 implementation in versions through 4.1.134.Final and 4.2.14.Final. The issue arises because the DefaultHttp2Connection.DefaultEndpoint sets maxActiveStreams and maxStreams to Integer.MAX_VALUE. Additionally, Http2Settings does not automatically include a limit on concurrent streams. As a result, unless an application explicitly sets a maximum, the server imposes no restrictions, allowing each open stream to consume resources by allocating various objects and entries. This misconfiguration can lead to excessive memory usage and create conditions for amplification attacks, similar to those described in CVE-2023-44487.
Users can upgrade to Netty versions 4.1.135.Final or 4.2.15.Final to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/releases/tag/netty-4.1.135.Final | [email protected] | Release Notes |
| https://github.com/netty/netty/releases/tag/netty-4.2.15.Final | [email protected] | Release Notes |
| https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty | < 4.1.135 >= 4.2.0, < 4.2.15 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | New CVE Received | [email protected] |