Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

中 5.3CVE-2026-47244 · GHSA-5x3r-wrvg-rp6q · 12/06/2026 公開 · 17/06/2026 更新

要点

CVE-2026-47244 は io.netty:netty-codec-http2, netty (netty) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.38%（全脆弱性の 32.5% より高い）。
対処：4.2.15.Final, 4.1.135.Final, 4.2.15, 4.1.135 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
io.netty:netty-codec-http2 Maven	`≥ 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final`	`4.2.15.Final4.1.135.Final`
netty netty	`≥ 4.2.0, < 4.2.15< 4.1.135`	`4.2.154.1.135`

概要

Impact

DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work.

Resources

https://www.rfc-editor.org/rfc/rfc7540.html#section-6.5.2

NVD の説明

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.