Netty, a Java network application framework, contained a flaw in its HTTP/2 implementation where the advertised MAX_CONCURRENT_STREAMS setting was not enforced. Because the default initialized stream limits to Integer.MAX_VALUE and no SETTINGS_MAX_CONCURRENT_STREAMS was sent, a client could open an unrestricted number of streams. Each stream consumes objects and internal state, so a single TCP connection could create hundreds of thousands of long‑lived stream objects, exhausting server memory and CPU resources. The unlimited stream count also enables amplification attacks in a style similar to CVE-2023-44487 by multiplying backend work. This uncontrolled resource consumption aligns with CWE‑400.

Netty versions prior to 4.1.135.Final and 4.2.15.Final are vulnerable. The issue affects the Netty network application framework, which is commonly used in Java‑based protocol servers and clients to implement HTTP/2 functionality. The patch is included in Netty 4.1.135.Final and Netty 4.2.15.Final releases and later.

The CVSS base score of 5.3 indicates a moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely targeted by malicious actors. An attacker would need to establish an HTTP/2 connection to a Netty‑based server and open many streams in order to trigger resource exhaustion. The lack of a hard limit makes this straightforward from the client side, but the exploit requires the presence of a vulnerable Netty server.