Excessive Streams Issue in Netty Framework by Netty
CVE-2026-47244
What is CVE-2026-47244?
The Netty framework, essential for building network applications, has a configuration oversight in its handling of HTTP/2 connections. Prior to the release of versions 4.1.135.Final and 4.2.15.Final, the framework allows unlimited concurrent streams due to the initialization of stream limits to Integer.MAX_VALUE. Without proper settings, this permits excessive stream creation which can lead to resource exhaustion. Each stream necessitates significant system resources, allowing for potential amplification attacks under specific conditions. The recent patches effectively address this issue by enforcing a controlled maximum concurrent streams configuration.
Affected Version(s)
netty >= 4.2.0.Final, < 4.2.15.Final < 4.2.0.Final, 4.2.15.Final
netty < 4.1.135.Final < 4.1.135.Final