The vulnerability lies in Netty's SpdySessionHandler, which defaults the maximum number of concurrent SPDY streams to Integer.MAX_VALUE and offers no way to change it. A malicious remote peer can send millions of SPDY_STREAM frames with the FIN flag cleared, forcing the server to allocate memory without bound. The resulting heap and direct memory exhaustion leads to a JVM OutOfMemoryError and crashes the service, providing a denial of service.

Vendors affected include Netty; any application that uses netty-codec-http version 4.1.137.Final or earlier, as well as versions from 4.2.0.Final through 4.2.17.Final, is vulnerable. The issue is specific to those releases of the Netty framework before 4.1.138.Final and 4.2.18.Final.

The CVSS score of 6.9 indicates a moderate severity. The attack does not require local or elevated privileges and can be carried out by any remote party that can open a SPDY connection to the service. While the EPSS score is not available, the lack of a known exploit and absence from the KEV list suggest a lower likelihood of widespread exploitation, though the impact of a successful denial of service remains significant.