CVE-2026-100655

Executive Summary

CVE-2026-100655 is an uncontrolled resource consumption vulnerability (CWE-770) in Netty's io.netty:netty-codec-http module affecting versions up to and including 4.1.137.Final and 4.2.0.Final through 4.2.17.Final. The SpdySessionHandler defaults localConcurrentStreams to Integer.MAX_VALUE and provides no API to lower it, allowing any remote peer to open unlimited concurrent remote-initiated SPDY streams by sending millions of SYN_STREAM frames with FLAG_FIN=0. This causes unbounded heap and direct memory allocation, leading to JVM OutOfMemoryError and service crash, yielding a CVSS 3.1 base score of 7.5 (High) with high availability impact.

Technical Analysis

The vulnerability resides in the SPDY protocol handling code of Netty's netty-codec-http module, specifically within SpdySessionHandler. SPDY is an obsolete (deprecated and largely removed from modern browsers) protocol that Netty continues to support in this codec for legacy deployments. The core defect is a resource-limit misconfiguration:

• SpdySessionHandler initializes localConcurrentStreams to Integer.MAX_VALUE.
• There is no public setter, constructor parameter, or configuration hook exposed to reduce this cap.
• Each incoming SYN_STREAM frame with FLAG_FIN=0 (indicating the stream remains open, i.e., not half-closed upon creation) causes the handler to track and retain per-stream state.

Because the concurrent stream ceiling is effectively unbounded, a remote attacker can open arbitrary numbers of long-lived streams. Each stream consumes server-side memory: stream state objects, associated buffers, and direct memory allocated for HTTP/SPDY semantics. Over time (or rapidly, with high frame rates), heap and direct memory grow without bound until the JVM exhausts memory and throws OutOfMemoryError. Depending on JVM flags (-XX:+ExitOnOutOfMemoryError), the process may terminate immediately, causing a hard denial of service.

Key characteristics:

• Attack vector: Network (AV:N), unauthenticated (PR:N, UI:N), no privileges required.
• Complexity: Low (AC:L) — the attack is a straightforward protocol-level flood.
• Scope: Unchanged (S:U) — impact is confined to the Netty-hosted service.
• Impact vector: Availability only (A:H); no confidentiality or integrity impact per CVSS.

The fix in 4.1.138.Final and 4.2.18.Final presumably enforces a bounded default for concurrent streams or introduces a configurable limit; NVD does not disclose the precise patch mechanism beyond the fixed version numbers.

Exploitation Scenarios

No public proof-of-concept exists. The following attack chain is inferred strictly from the vulnerability class (unbounded concurrent stream allocation) and the NVD description:

1. Reconnaissance / Target Identification. The attacker identifies a public-facing service running Netty with SPDY enabled (typically via TLS ALPN negotiation advertising spdy/3.1 or spdy/3, or by observing Netty's HTTP server behavior). Services that have not disabled the SPDY codec (often legacy or misconfigured deployments, sometimes reintroduced inadvertently via dependency bundling) are candidates.

2. Triggering the Flaw. The attacker establishes a SPDY connection to the target. Under SPDY, the client opens streams by sending SYN_STREAM frames. The attacker sends an arbitrarily large number of SYN_STREAM frames with FLAG_FIN=0. Because localConcurrentStreams is Integer.MAX_VALUE, SpdySessionHandler does not reject or throttle these streams. Each frame results in new stream state being created and retained.

3. Sustained Flood. The attacker maintains the streams (no FIN), continually allocating more streams and associated heap/direct memory. No application-layer authentication or authorization gates the SPDY frame handling at the codec level; the flood proceeds purely at the protocol layer.

4. Post-Exploitation Impact. Memory growth continues until the JVM throws OutOfMemoryError. The Netty service crashes, denying access to all legitimate users. This is a classic resource-exhaustion DoS; there is no code execution, data exfiltration, or lateral movement component per the CVSS vector (C:N/I:N/A:H).

The attack is single-source feasible (one connection generating many frames), complicating rate-limit defenses based on connection counting alone. Because no exploit code is public, real-world weaponization is not currently observed, but the barrier to entry for a competent attacker constructing SPDY frame floods is low.

Impact Assessment

• Business Impact: Full availability loss for the affected service. If the Netty-based service is a gateway, proxy, or API server, downstream dependent services may experience cascading outages. Recovery requires a JVM restart, causing additional downtime.
• Affected Systems: Any Java application embedding io.netty:netty-codec-http within the affected version range and exposing a SPDY-capable listener (or accepting SPDY frames). This includes custom servers, gateways, and any product shipping the affected Netty version.
• Blast Radius: Scope is unchanged (S:U) — impact confined to the target JVM process. However, repeated exploitation can render a service permanently unavailable.
• CVSS Subscores: AV:N (remotely exploitable), AC:L (low attack complexity), PR:N (no privileges), UI:N (no user interaction), C:N/I:N (no data compromise), A:H (high availability impact). Base score 7.5 (High).
• EPSS: Not yet scored by FIRST.org; no exploit maturity data available.
• CISA KEV: Not listed; no confirmed in-the-wild exploitation by CISA as of this writing.

Detection Guidance

Sigma Rule

title: Netty SPDY SYN_STREAM Flood (CVE-2026-100655)
id: 8f4c2e91-1a7b-4d3e-9c2f-0a1b2c3d4e5f
status: experimental
description: Detects high-volume SPDY SYN_STREAM frame activity indicative of concurrent stream exhaustion against Netty SpdySessionHandler.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100655
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: application
  product: netty
detection:
  selection_protocol:
    protocol|contains: 'SPDY'
  selection_frames:
    frame_type: 'SYN_STREAM'
    flag_fin: 0
  condition: selection_protocol and selection_frames
fields:
  - src_ip
  - frame_type
  - stream_id
falsepositives:
  - Legitimate high-concurrency SPDY clients in legacy environments
level: high

YARA Rule

rule CVE_2026_100655_Netty_SPDY_Flood
{
    meta:
        description = "Detects SPDY SYN_STREAM frame bursts targeting Netty SpdySessionHandler"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100655"
        date = "2026-01-01"
        severity = "high"
    strings:
        $syn_stream_lo = { 80 03 00 }  // SPDY control frame SYN_STREAM variant (low bytes)
        $spdy3_signature = { 80 03 }   // SPDY/3 control frame marker
        $netty_class = "SpdySessionHandler" ascii
        $netty_pkg = "io.netty" ascii
    condition:
        uint16be(0) == 0x8003 or $syn_stream_lo or ($netty_class and $netty_pkg)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-100655 Netty SPDY SYN_STREAM Flood Attempt"; flow:established,to_server; content:"|80 03 00 01|"; depth:4; threshold: type both, track by_src, count 100, seconds 10; classtype:attempted-dos; sid:2026100655; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-100655;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where network.protocol == "spdy" and spdy.frame_type == "SYN_STREAM"]
  [network where network.protocol == "spdy" and spdy.frame_type == "SYN_STREAM"]
  [network where network.protocol == "spdy" and spdy.frame_type == "SYN_STREAM"]

Splunk SPL Query

index=network sourcetype=netty:spdy frame_type="SYN_STREAM" flag_fin=0
| bin _time span=10s
| stats count as syn_count dc(stream_id) as unique_streams by src_ip _time
| where syn_count > 100
| table _time src_ip syn_count unique_streams

Wazuh OSSEC Rule

<group name="netty,spdy,denial_of_service,">
  <rule id="100655" level="12">
    <decoded_as>json</decoded_as>
    <field name="protocol">SPDY</field>
    <field name="frame_type">SYN_STREAM</field>
    <field name="flag_fin">0</field>
    <description>CVE-2026-100655: High-volume Netty SPDY SYN_STREAM frames detected - possible concurrent stream exhaustion DoS.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,spdy,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or advisory was provided by tracked sources, despite NVD referencing fixed versions.

1. Immediate Mitigations:

   • Disable SPDY entirely if not required. SPDY is deprecated; most modern deployments should use HTTP/2. Removing or disabling the SPDY codec eliminates the attack surface.
   • If SPDY cannot be removed, enforce connection- and stream-rate limits at a fronting reverse proxy / WAF, and terminate SPDY at the edge before forwarding to the Netty backend.
   • Apply JVM memory limits (-Xmx, -XX:MaxDirectMemorySize) and configure -XX:+ExitOnOutOfMemoryError only with orchestrated auto-restart to reduce unavailability windows.
   • Cap concurrent connections per source IP and monitor for abnormal SPDY frame rates.

2. Patch / Upgrade Steps:

   • Upgrade Netty to 4.1.138.Final or 4.2.18.Final (per NVD). Verify dependency trees (mvn dependency:tree) for transitive Netty inclusions and force-upgrade via dependency management.
   • Since patch confidence is 0/4, validate the fixed version independently and confirm localConcurrentStreams enforcement in the upgraded SpdySessionHandler.

3. Long-Term Hardening:

   • Inventory all services exposing SPDY and decommission legacy protocol support.
   • Implement resource quotas and backpressure for all remote-initiated stream protocols.
   • Include Netty version monitoring in SBOM/dependency scanning with alerts on affected ranges.

References

• NVD — CVE-2026-100655
• Netty Project
• CWE-770: Allocation of Resources Without Limits or Throttling
• MITRE ATT&CK T1499 — Endpoint Denial of Service
• FIRST.org EPSS — CVE-2026-100655 not yet scored

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild campaign evidence was identified for CVE-2026-100655 at the time of reporting. CISA KEV status: not listed.