5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47244

CVE-2026-47244: Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47244

CVE-2026-47244:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-http2	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-codec-http2	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-5x3r-wrvg-rp6q, exists because Netty's HTTP/2 server implementation did not enforce a default limit on the number of concurrent streams a client could open. The DefaultHttp2Connection.DefaultEndpoint would initialize its maxActiveStreams to Integer.MAX_VALUE. An attacker could exploit this by repeatedly opening new streams on a single connection, leading to uncontrolled resource consumption (denial-of-service) on the server.

The patch, found in commit f5da73e6fcde976020b336dc7d44808f61b3e70c, rectifies this by proactively setting a limit on the remote endpoint during the connection handler's initialization. This is done in the AbstractHttp2ConnectionHandlerBuilder class, within the buildFromConnection and buildFromCodec methods. A new method, enforceMaxActiveStreams, is introduced and called from these builder methods to apply either the user-defined maxConcurrentStreams setting or a sane default (100) if none is provided.

During an exploit, the io.netty.handler.codec.http2.DefaultHttp2Connection$DefaultEndpoint.createStream function would be the one appearing in a runtime profile, as it is invoked for every new stream request. The root cause, however, lies in the AbstractHttp2ConnectionHandlerBuilder methods (build, buildFromConnection, buildFromCodec) which failed to properly configure the stream limit in the first place.

Vulnerable functions

io.netty.handler.codec.http2.AbstractHttp2ConnectionHandlerBuilder.build

codec-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java

This public method is used to build the `Http2ConnectionHandler`. In vulnerable versions, it constructs a handler that does not enforce a limit on the maximum number of concurrent streams, as the `maxActiveStreams` for the remote endpoint defaults to `Integer.MAX_VALUE`. This allows a client to create an excessive number of streams, leading to resource exhaustion.

io.netty.handler.codec.http2.DefaultHttp2Connection$DefaultEndpoint.createStream

codec-http2/src/main/java/io/netty/handler/codec/http2/DefaultHttp2Connection.java

This function is responsible for creating a new HTTP/2 stream. During an attack, this function would be called for each new stream requested by a malicious client. In vulnerable versions, the check against `maxActiveStreams` would always pass because the limit was not properly configured by the `AbstractHttp2ConnectionHandlerBuilder`, allowing for a virtually unlimited number of streams to be created, leading to a denial-of-service.

io.netty.handler.codec.http2.AbstractHttp2ConnectionHandlerBuilder.buildFromConnection

codec-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java

This internal builder method was modified to apply the `maxConcurrentStreams` limit. Before this patch, it would proceed to build the connection handler without setting this crucial limit on the remote endpoint, directly contributing to the vulnerability.

io.netty.handler.codec.http2.AbstractHttp2ConnectionHandlerBuilder.buildFromCodec

codec-http2/src/main/java/io/netty/handler/codec/http2/AbstractHttp2ConnectionHandlerBuilder.java

Similar to `buildFromConnection`, this internal builder method was modified to enforce the `maxConcurrentStreams` limit. Its failure to do so in unpatched versions created the vulnerable condition where a client could open an unlimited number of streams.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.