PT-2026-47612 · Netty · Netty

Published 2026-06-08 · Updated 2026-06-12 · CVE-2026-47244

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.135.Final Netty versions prior to 4.2.15.Final

Description In the network application framework, DefaultHttp2Connection.DefaultEndpoint initializes maxActiveStreams and maxStreams to Integer.MAX VALUE, while Http2Settings does not insert SETTINGS MAX CONCURRENT STREAMS by default. If the application does not explicitly call initialSettings().maxConcurrentStreams(n), the HTTP/2 server advertises and enforces no limit on concurrent streams. This allows a single TCP connection to create hundreds of thousands of long-lived stream objects, as each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state, and an IntObjectHashMap entry. This condition also enables Rapid-Reset amplification, where the lack of a low concurrent cap increases the workload on the backend.

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final. As a temporary mitigation, explicitly call initialSettings().maxConcurrentStreams(n) to define a limit for concurrent streams.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-47244

GHSA-5X3R-WRVG-RP6Q

Affected Products

Netty

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-47244 · Security Note
• https://osv.dev/vulnerability/GHSA-5x3r-wrvg-rp6q · Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note
• https://twitter.com/VulmonFeeds/status/2065478588405563563 · Twitter Post