CVE-2026-100655

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Sep 9, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 2:16:48 PM UTC

Source

[NVD] · [CVE record]

A flaw was found in Netty. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by exhausting server memory. Because the SPDY session handler does not restrict the number of concurrent streams initiated by a remote peer, an attacker can transmit an excessive volume of stream creation requests over a connection, triggering memory exhaustion and crashing the application. io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams This vulnerability is rated as having an Important impact because an unauthenticated remote attacker can exhaust system memory and induce a denial of service, crashing the entire Java Virtual Machine without requiring prior privileges. Within Red Hat offerings, Netty is primarily utilized as an underlying networking transport framework across various middleware, developer tools, and containerized services. The exposure is limited to deployments and services where SPDY protocol handlers are actively integrated into the communication pipeline, as default HTTP configurations do not process these sessions. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.