### Impact DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. ### Resources https://www.rfc-editor.org/rfc/rfc7540.html#section-6.5.2
Update io.netty:netty-codec-http2 to 4.2.15.Final; io.netty:netty-codec-http2 to 4.1.135.Final if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanNetty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced affects io.netty:netty-codec-http2 (maven), io.netty:netty-codec-http2 (maven). Severity is medium. ### Impact DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. ### Resources https://www.rfc-editor.org/rfc/rfc7540.html#section-6.5.2
AI coding agents often install or upgrade packages automatically in maven. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
### Impact DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. ### Resources https://www.rfc-editor.org/rfc/rfc7540.html#section-6.5.2
Update io.netty:netty-codec-http2 to 4.2.15.Final; io.netty:netty-codec-http2 to 4.1.135.Final if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanNetty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced affects io.netty:netty-codec-http2 (maven), io.netty:netty-codec-http2 (maven). Severity is medium. ### Impact DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. ### Resources https://www.rfc-editor.org/rfc/rfc7540.html#section-6.5.2
AI coding agents often install or upgrade packages automatically in maven. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package |
|---|
| Affected range |
|---|
| Fixed version |
|---|
| io.netty:netty-codec-http2maven | >=4.2.0.Final,<=4.2.14.Final | 4.2.15.Final |
|---|---|---|
| io.netty:netty-codec-http2maven | <=4.1.134.Final | 4.1.135.Final |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Package |
|---|
| Affected range |
|---|
| Fixed version |
|---|
| io.netty:netty-codec-http2maven | >=4.2.0.Final,<=4.2.14.Final | 4.2.15.Final |
|---|---|---|
| io.netty:netty-codec-http2maven | <=4.1.134.Final | 4.1.135.Final |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard