CVE-2026-100655

Rejected reason: This CVE ID has been rejected as a duplicate.

CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

28 Sep 2026, 22:17

Type	Values Removed	Values Added
Summary	(en) Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE and exposes no API to change it. A remote peer that opens a SPDY connection and sends millions of SYN_STREAM frames with FLAG_FIN=0 causes the server to allocate unbounded heap and direct memory, eventually triggering a JVM OutOfMemoryError and crashing the service. Fixed in 4.1.138.Final and 4.2.18.Final.	(en) Rejected reason: This CVE ID has been rejected as a duplicate.
CWE	~~CWE-770~~
References	~~{'url': 'https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7', 'source': 'disclosure@vulncheck.com'}~~ ~~{'url': 'https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-spdysessionhandler', 'source': 'disclosure@vulncheck.com'}~~
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : unknown

26 Sep 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-26 14:16

Updated : 2026-09-28 22:17

NVD link : CVE-2026-100655

Mitre link : CVE-2026-100655

CVE.ORG link : CVE-2026-100655

JSON object : View

Products Affected

No product.

CWE

No CWE.