Netty’s SPDY SETTINGS decoder accepted an arbitrary number of settings entries up to the 24‑bit frame‑length limit, materializing each unique ID into a map. An attacker can send a syntactically valid SETTINGS frame of roughly 2 MiB that creates 262,144 map entries, causing significant heap growth and ordered‑map insertion work. The flaw leads to memory exhaustion and a denial‑of‑service condition but does not allow code execution.

The vulnerability affects Netty version 4.1.x prior to 4.1.136.Final and Netty 4.2.x prior to 4.2.16.Final. Any application that includes these Netty releases and uses SPDY/3.1 over the network is susceptible.

With a CVSS score of 7.5 the flaw presents a medium‑high impact, yet the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog. An attacker needs only a reachable Netty instance that accepts SPDY traffic and can send a large SETTINGS frame; no prior authentication or privileged access is required, making the attack vector remote and straightforward. Due to the low exploitation likelihood the risk is moderate, but if an attacker succeeds the resulting DoS could interrupt service.